change(version): Update version to 5.2.4

feat(802.15.4): support ieee802154 get rssi comp from phylib (v5.2)

See merge request espressif/esp-idf!37053

.gitlab/ci/build.yml

@@ -1,7 +1,7 @@
 .build_template:
   stage: build
   extends:
-    - .after_script:build:ccache
+    - .after_script:build:ccache-show-stats
   image: $ESP_ENV_IMAGE
   tags:
     - build
@@ -16,7 +16,7 @@
   extends:
     - .build_template
     - .before_script:build
-    - .after_script:build:ccache
+    - .after_script:build:ccache-show-stats
   dependencies: # set dependencies to null to avoid missing artifacts issue
   needs:
     - job: fast_template_app
@@ -541,7 +541,7 @@ pytest_build_system_macos:
   extends:
     - .test_build_system_template
     - .before_script:build:macos
-    - .after_script:build:macos:upload-when-fail
+    - .after_script:build:macos:upload-failed-job-logs:ccache-show-stats
     - .rules:build:macos
   tags:
     - macos_shell
@@ -556,8 +556,9 @@ pytest_build_system_macos:
       junit: XUNIT_RESULT.xml
   variables:
     PYENV_VERSION: "3.8"
-    CI_CCACHE_DISABLE: "1"  # ccache: error: Read-only file system
-
+    # CCACHE_DIR: "/cache/idf_ccache". On macOS, you cannot write to this folder due to insufficient permissions.
+    CCACHE_DIR: "" # ccache will use "$HOME/Library/Caches/ccache".
+    CCACHE_MAXSIZE: "5G" # To preserve the limited Macbook storage. CCACHE automatically prunes old caches to fit the set limit.
 build_docker:
   extends:
     - .before_script:minimal

.gitlab/ci/common.yml

@@ -6,20 +6,20 @@ stages:
   - pre_check
   - build
   - assign_test
+  - build_doc
   - target_test
   - host_test
-  - build_doc
   - test_deploy
   - deploy
   - post_deploy
 
 variables:
-# System environment
+  # System environment
 
   # Common parameters for the 'make' during CI tests
   MAKEFLAGS: "-j5 --no-keep-going"
 
-# GitLab-CI environment
+  # GitLab-CI environment
   # Thanks to pack-objects cache, clone strategy should behave faster than fetch
   #   so we pick "clone" as default git strategy
   # Shiny runners by default remove the CI_PROJECT_DIR every time at the beginning of one job
@@ -39,7 +39,7 @@ variables:
   GIT_FETCH_EXTRA_FLAGS: "--no-recurse-submodules --prune --prune-tags"
   # we're using .cache folder for caches
   GIT_CLEAN_FLAGS: -ffdx -e .cache/
-  LATEST_GIT_TAG: v5.2.3
+  LATEST_GIT_TAG: v5.2.4
 
   SUBMODULE_FETCH_TOOL: "tools/ci/ci_fetch_submodule.py"
   # by default we will fetch all submodules
@@ -207,13 +207,14 @@ variables:
     - *setup_tools_and_idf_python_venv
     - fetch_submodules
 
-.after_script:build:macos:upload-when-fail:
+.after_script:build:macos:upload-failed-job-logs:ccache-show-stats:
   after_script:
     # macos is running shell executor, which means it would use
     # the system installed /usr/local/bin/python3 by default.
     # Ensure pyenv and PYENV_VERSION installed
     - eval "$(pyenv init -)"
     - *upload_failed_job_log_artifacts
+    - *show_ccache_statistics
 
 .before_script:build:
   before_script:
@@ -224,7 +225,7 @@ variables:
     - export EXTRA_CFLAGS=${PEDANTIC_CFLAGS}
     - export EXTRA_CXXFLAGS=${PEDANTIC_CXXFLAGS}
 
-.after_script:build:ccache:
+.after_script:build:ccache-show-stats:
   after_script:
     - *show_ccache_statistics
     - *upload_failed_job_log_artifacts

.gitlab/ci/docs.yml

@@ -37,25 +37,16 @@
 .if-dev-push: &if-dev-push
   if: '$CI_COMMIT_REF_NAME != "master" && $CI_COMMIT_BRANCH !~ /^release\/v/ && $CI_COMMIT_TAG !~ /^v\d+\.\d+(\.\d+)?($|-)/ && $CI_COMMIT_TAG !~ /^qa-test/ && ($CI_PIPELINE_SOURCE == "push" || $CI_PIPELINE_SOURCE == "merge_request_event")'
 
-.if-schedule: &if-schedule
-  if: '$CI_PIPELINE_SOURCE == "schedule"'
-
 .doc-rules:build:docs-full:
   rules:
     - <<: *if-qa-test-tag
       when: never
-    - <<: *if-schedule
+    - <<: *if-protected
     - <<: *if-label-build_docs
     - <<: *if-label-docs_full
     - <<: *if-dev-push
       changes: *patterns-docs-full
 
-.doc-rules:build:docs-full-prod:
-  rules:
-    - <<: *if-qa-test-tag
-      when: never
-    - <<: *if-protected-no_label
-
 .doc-rules:build:docs-partial:
   rules:
     - <<: *if-qa-test-tag
@@ -92,6 +83,10 @@ check_docs_lang_sync:
   stage: build_doc
   tags:
     - build_docs
+  needs:
+    - job: fast_template_app
+      artifacts: false
+      optional: true
   script:
     - if [ -n "${BREATHE_ALT_INSTALL_URL}" ]; then pip uninstall -y breathe && pip install -U ${BREATHE_ALT_INSTALL_URL}; fi
     - cd docs
@@ -116,24 +111,6 @@ build_docs_html_full:
   extends:
     - .build_docs_template
     - .doc-rules:build:docs-full
-  needs:
-    - job: fast_template_app
-      artifacts: false
-      optional: true
-  artifacts:
-    when: always
-    paths:
-      - docs/_build/*/*/*.txt
-      - docs/_build/*/*/html/*
-    expire_in: 4 days
-  variables:
-    DOC_BUILDERS: "html"
-
-build_docs_html_full_prod:
-  extends:
-    - .build_docs_template
-    - .doc-rules:build:docs-full-prod
-  dependencies: [] # Stop build_docs jobs from downloading all previous job's artifacts
   artifacts:
     when: always
     paths:
@@ -147,10 +124,6 @@ build_docs_html_partial:
   extends:
     - .build_docs_template
     - .doc-rules:build:docs-partial
-  needs:
-    - job: fast_template_app
-      artifacts: false
-      optional: true
   artifacts:
     when: always
     paths:
@@ -170,28 +143,12 @@ build_docs_pdf:
   extends:
     - .build_docs_template
     - .doc-rules:build:docs-full
-  needs:
-    - job: fast_template_app
-      artifacts: false
-      optional: true
-  artifacts:
-    when: always
-    paths:
-      - docs/_build/*/*/latex/*
-    expire_in: 4 days
-  variables:
-    DOC_BUILDERS: "latex"
-
-build_docs_pdf_prod:
-  extends:
-    - .build_docs_template
-    - .doc-rules:build:docs-full-prod
-  dependencies: [] # Stop build_docs jobs from downloading all previous job's artifacts
   artifacts:
     when: always
     paths:
       - docs/_build/*/*/latex/*
     expire_in: 4 days
+  allow_failure: true # TODO IDFCI-2216
   variables:
     DOC_BUILDERS: "latex"
 
@@ -239,12 +196,13 @@ deploy_docs_production:
   # The DOCS_PROD_* variables used by this job are "Protected" so these branches must all be marked "Protected" in Gitlab settings
   extends:
     - .deploy_docs_template
-    - .doc-rules:build:docs-full-prod
+  rules:
+    - <<: *if-protected-no_label
   stage: post_deploy
   dependencies:  # set dependencies to null to avoid missing artifacts issue
   needs: # ensure runs after push_to_github succeeded
-    - build_docs_html_full_prod
-    - build_docs_pdf_prod
+    - build_docs_html_full
+    - build_docs_pdf
     - job: push_to_github
       artifacts: false
   variables:
@@ -259,7 +217,8 @@ deploy_docs_production:
 check_doc_links:
   extends:
     - .build_docs_template
-    - .doc-rules:build:docs-full-prod
+  rules:
+    - <<: *if-protected-no_label
   stage: post_deploy
   needs:
     - job: deploy_docs_production

.gitlab/ci/rules.yml

@@ -435,15 +435,6 @@
     - <<: *if-dev-push
       changes: *patterns-python-files
 
-.rules:patterns:static-code-analysis-preview:
-  rules:
-    - <<: *if-dev-push
-      changes: *patterns-c-files
-    - <<: *if-dev-push
-      changes: *patterns-python-files
-    - <<: *if-dev-push
-      changes: *patterns-sonarqube-files
-
 # !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
 # DO NOT place comments or maintain any code from this line
 #

.gitlab/ci/static-code-analysis.yml

@@ -36,82 +36,3 @@ check_pylint:
       fi
     - if [ -z "$files" ]; then echo "No python files found"; exit 0; fi
     - run_cmd pylint --exit-zero --load-plugins=pylint_gitlab --output-format=gitlab-codeclimate:pylint.json $files
-
-# build stage
-# Sonarqube related jobs put here for this reason:
-# Here we have two jobs. code_quality_check and code_quality_report.
-#
-# code_quality_check will analyze the code changes between your MR and
-# code repo stored in sonarqube server. The analysis result is only shown in
-# the comments under this MR and won't be transferred to the server.
-#
-# code_quality_report will analyze and transfer both of the newly added code
-# and the analysis result to the server.
-#
-# Put in the front to ensure that the newly merged code can be stored in
-# sonarqube server ASAP, in order to avoid reporting unrelated code issues
-.sonar_scan_template:
-  stage: build
-  extends: .pre_check_template
-  image:
-    name: $SONARQUBE_SCANNER_IMAGE
-  before_script:
-    - source tools/ci/utils.sh
-    - export PYTHONPATH="$CI_PROJECT_DIR/tools:$CI_PROJECT_DIR/tools/ci/python_packages:$PYTHONPATH"
-    - fetch_submodules
-    # Exclude the submodules, all paths ends with /**
-    - submodules=$(get_all_submodules)
-    # get all exclude paths specified in tools/ci/sonar_exclude_list.txt | ignore lines start with # | xargs | replace all <space> to <comma>
-    - custom_excludes=$(cat $CI_PROJECT_DIR/tools/ci/sonar_exclude_list.txt | grep -v '^#' | xargs | sed -e 's/ /,/g')
-    # Exclude the report dir as well
-    - export EXCLUSIONS="$custom_excludes,$submodules"
-    - export SONAR_SCANNER_OPTS="-Xmx2048m"
-  variables:
-    GIT_DEPTH: 0
-    REPORT_PATTERN: clang_tidy_reports/*.txt
-  artifacts:
-    when: always
-    paths:
-      - $REPORT_PATTERN
-    expire_in: 1 week
-  dependencies:  # Here is not a hard dependency relationship, could be skipped when only python files changed. so we do not use "needs" here.
-    - clang_tidy_check
-
-code_quality_check:
-  extends:
-    - .sonar_scan_template
-    - .rules:patterns:static-code-analysis-preview
-  allow_failure: true  # since now it's using exit code to indicate the code analysis result,
-                       # we don't want to block ci when critical issues founded
-  script:
-    - export CI_MERGE_REQUEST_COMMITS=$(python ${CI_PROJECT_DIR}/tools/ci/ci_get_mr_info.py commits --src-branch ${CI_COMMIT_REF_NAME} | tr '\n' ',')
-    # test if this branch have merge request, if not, exit 0
-    - test -n "$CI_MERGE_REQUEST_IID" || exit 0
-    - test -n "$CI_MERGE_REQUEST_COMMITS" || exit 0
-    - sonar-scanner
-      -Dsonar.analysis.mode=preview
-      -Dsonar.branch.name=$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME
-      -Dsonar.cxx.clangtidy.reportPath=$REPORT_PATTERN
-      -Dsonar.exclusions=$EXCLUSIONS
-      -Dsonar.gitlab.ci_merge_request_iid=$CI_MERGE_REQUEST_IID
-      -Dsonar.gitlab.commit_sha=$CI_MERGE_REQUEST_COMMITS
-      -Dsonar.gitlab.merge_request_discussion=true
-      -Dsonar.gitlab.ref_name=$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME
-      -Dsonar.host.url=$SONAR_HOST_URL
-      -Dsonar.login=$SONAR_LOGIN
-
-code_quality_report:
-  extends:
-    - .sonar_scan_template
-    - .rules:protected
-  allow_failure: true  # since now it's using exit code to indicate the code analysis result,
-                       # we don't want to block ci when critical issues founded
-  script:
-    - sonar-scanner
-      -Dsonar.branch.name=$CI_COMMIT_REF_NAME
-      -Dsonar.cxx.clangtidy.reportPath=$REPORT_PATTERN
-      -Dsonar.exclusions=$EXCLUSIONS
-      -Dsonar.gitlab.commit_sha=$PIPELINE_COMMIT_SHA
-      -Dsonar.gitlab.ref_name=$CI_COMMIT_REF_NAME
-      -Dsonar.host.url=$SONAR_HOST_URL
-      -Dsonar.login=$SONAR_LOGIN

.pre-commit-config.yaml

@@ -70,7 +70,7 @@ repos:
         entry: tools/ci/check_kconfigs.py
         language: python
         additional_dependencies:
-          - esp-idf-kconfig>=1.4.2,<2.0.0
+          - esp-idf-kconfig>=1.5.0,<2.0.0
         files: '^Kconfig$|Kconfig.*$'
       - id: check-deprecated-kconfigs-options
         name: Check if any Kconfig Options Deprecated

CMakeLists.txt

@@ -134,6 +134,10 @@ if(CONFIG_COMPILER_OPTIMIZATION_ASSERTIONS_DISABLE)
     list(APPEND compile_definitions "-DNDEBUG")
 endif()
 
+if(CONFIG_COMPILER_NO_MERGE_CONSTANTS)
+    list(APPEND compile_options "-fno-merge-constants")
+endif()
+
 if(CONFIG_COMPILER_STACK_CHECK_MODE_NORM)
     list(APPEND compile_options "-fstack-protector")
 elseif(CONFIG_COMPILER_STACK_CHECK_MODE_STRONG)
@@ -146,6 +150,10 @@ if(CONFIG_COMPILER_DUMP_RTL_FILES)
     list(APPEND compile_options "-fdump-rtl-expand")
 endif()
 
+idf_build_set_property(GDBINIT_FILES_PREFIX_MAP "${BUILD_DIR}/gdbinit/prefix_map")
+file(MAKE_DIRECTORY "${BUILD_DIR}/gdbinit")
+file(WRITE "${BUILD_DIR}/gdbinit/prefix_map" "")
+
 if(NOT ${CMAKE_C_COMPILER_VERSION} VERSION_LESS 8.0.0)
     if(CONFIG_COMPILER_HIDE_PATHS_MACROS)
         list(APPEND compile_options "-fmacro-prefix-map=${CMAKE_SOURCE_DIR}=.")

Kconfig

@@ -496,6 +496,15 @@ mainmenu "Espressif IoT Development Framework Configuration"
             help
                 Stack smashing protection.
 
+        config COMPILER_NO_MERGE_CONSTANTS
+            bool "Disable merging const sections"
+            depends on IDF_TOOLCHAIN_GCC
+            help
+                Disable merging identical constants (string/floating-point) across compilation units.
+                This helps in better size analysis of the application binary as the rodata section
+                distribution is more uniform across libraries. On downside, it may increase
+                the binary size and hence should be used during development phase only.
+
         config COMPILER_WARN_WRITE_STRINGS
             bool "Enable -Wwrite-strings warning flag"
             default "n"
@@ -583,7 +592,7 @@ mainmenu "Espressif IoT Development Framework Configuration"
             config COMPILER_ORPHAN_SECTIONS_WARNING
                 bool "Place with warning"
                 help
-                    Places orphan sections without a warning message.
+                    Places orphan sections with a warning message.
 
             config COMPILER_ORPHAN_SECTIONS_PLACE
                 bool "Place silently"
@@ -611,4 +620,5 @@ mainmenu "Espressif IoT Development Framework Configuration"
             - CONFIG_ESPTOOLPY_FLASHFREQ_120M && CONFIG_ESPTOOLPY_FLASH_SAMPLE_MODE_DTR
             - CONFIG_SPIRAM_SPEED_120M && CONFIG_SPIRAM_MODE_OCT
             - CONFIG_BOOTLOADER_CACHE_32BIT_ADDR_QUAD_FLASH
-            - CONFIG_MBEDTLS_USE_CRYPTO_ROM_IMPL
+            - CONFIG_USB_HOST_EXT_PORT_SUPPORT_LS
+            - CONFIG_USB_HOST_EXT_PORT_RESET_ATTEMPTS

components/app_trace/sys_view/ext/heap_trace_module.c

@@ -21,7 +21,7 @@ const static char *TAG = "sysview_heap_trace";
 #endif
 
 static SEGGER_SYSVIEW_MODULE s_esp_sysview_heap_module = {
-    .sModule = "ESP32 SystemView Heap Tracing Module",
+    .sModule = "M=ESP32 SystemView Heap Tracing Module",
     .NumEvents = 2,
 };
 

components/app_update/test_apps/.build-test-rules.yml

@@ -1,7 +0,0 @@
-# Documentation: .gitlab/ci/README.md#manifest-file-to-control-the-buildtest-apps
-
-components/app_update/test_apps:
-  disable:
-    - if: IDF_TARGET in ["esp32c6", "esp32h2", "esp32p4"]
-      temporary: true
-      reason: target esp32c6, esp32h2, esp32p4 is not supported yet # TODO: IDF-8068

components/app_update/test_apps/pytest_app_update_ut.py

@@ -1,32 +0,0 @@
-# SPDX-FileCopyrightText: 2022-2023 Espressif Systems (Shanghai) CO LTD
-# SPDX-License-Identifier: Unlicense OR CC0-1.0
-import re
-
-import pytest
-from pytest_embedded import Dut
-
-DEFAULT_TIMEOUT = 20
-TEST_SUBMENU_PATTERN_PYTEST = re.compile(rb'\s+\((\d+)\)\s+"([^"]+)"\r?\n')
-
-
-def run_multiple_stages(dut: Dut, test_case_num: int, stages: int) -> None:
-    for stage in range(1, stages + 1):
-        dut.write(str(test_case_num))
-        dut.expect(TEST_SUBMENU_PATTERN_PYTEST, timeout=DEFAULT_TIMEOUT)
-        dut.write(str(stage))
-        if stage != stages:
-            dut.expect_exact('Press ENTER to see the list of tests.')
-
-
-@pytest.mark.supported_targets
-@pytest.mark.temp_skip_ci(targets=['esp32c6', 'esp32h2'], reason='c6/h2 support TBD')
-@pytest.mark.generic
-def test_app_update(dut: Dut) -> None:
-    extra_data = dut.parse_test_menu()
-    for test_case in extra_data:
-        if test_case.type != 'multi_stage':
-            dut.write(str(test_case.index))
-        else:
-            run_multiple_stages(dut, test_case.index, len(test_case.subcases))
-        dut.expect_unity_test_output(timeout=90)
-        dut.expect_exact("Enter next test, or 'enter' to see menu")

components/app_update/test_apps/test_app_update/.build-test-rules.yml

@@ -0,0 +1,12 @@
+# Documentation: .gitlab/ci/README.md#manifest-file-to-control-the-buildtest-apps
+
+components/app_update/test_apps:
+  enable:
+    - if: CONFIG_NAME == "defaults" and IDF_TARGET != "linux"
+    - if: CONFIG_NAME == "xip_psram" and IDF_TARGET in ["esp32s2", "esp32s3"]
+    # S2 doesn't have ROM for flash
+    - if: CONFIG_NAME == "xip_psram_with_rom_impl" and IDF_TARGET in ["esp32s3"]
+  disable:
+    - if: IDF_TARGET in ["esp32c6", "esp32h2", "esp32p4"]
+      temporary: true
+      reason: target esp32c6, esp32h2 are not supported yet # TODO: IDF-8068

components/app_update/test_apps/test_app_update/main/CMakeLists.txt

@@ -1,4 +1,4 @@
 idf_component_register(SRC_DIRS "."
                        PRIV_INCLUDE_DIRS "."
-                       PRIV_REQUIRES cmock test_utils app_update bootloader_support nvs_flash driver spi_flash
+                       PRIV_REQUIRES cmock test_utils app_update bootloader_support nvs_flash driver spi_flash esp_psram
                       WHOLE_ARCHIVE)

components/app_update/test_apps/test_app_update/main/test_ota_ops.c

@@ -6,6 +6,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include "esp_log.h"
 #include <freertos/FreeRTOS.h>
 #include <freertos/task.h>
 #include <freertos/semphr.h>
@@ -113,3 +114,11 @@ TEST_CASE("esp_ota_get_partition_description", "[ota]")
     };
     TEST_ESP_ERR(ESP_ERR_NOT_FOUND, bootloader_common_get_partition_description(&not_app_pos, &app_desc1));
 }
+
+TEST_CASE("esp_ota_get_running_partition points to correct address", "[spi_flash]")
+{
+    const esp_partition_t *factory = esp_partition_find_first(ESP_PARTITION_TYPE_APP, ESP_PARTITION_SUBTYPE_ANY, "factory");
+    const esp_partition_t* part = esp_ota_get_running_partition();
+    ESP_LOGI("running bin", "0x%p", (void*)part->address);
+    TEST_ASSERT_EQUAL_HEX32(factory->address, part->address);
+}

components/app_update/test_apps/test_app_update/main/test_switch_ota.c

@@ -842,7 +842,7 @@ static void test_flow6(void)
 TEST_CASE_MULTIPLE_STAGES("Switching between factory, OTA0 using esp_ota_write_with_offset", "[app_update][timeout=90][reset=DEEPSLEEP_RESET, DEEPSLEEP_RESET]", start_test, test_flow6, test_flow6);
 
 //IDF-5145
-TEST_CASE("Test bootloader_common_get_sha256_of_partition returns ESP_ERR_IMAGE_INVALID when image is ivalid", "[partitions]")
+TEST_CASE("Test bootloader_common_get_sha256_of_partition returns ESP_ERR_IMAGE_INVALID when image is invalid", "[partitions]")
 {
     const esp_partition_t *cur_app = esp_ota_get_running_partition();
     ESP_LOGI(TAG, "copy current app to next part");

components/app_update/test_apps/test_app_update/pytest_app_update_ut.py

@@ -0,0 +1,51 @@
+# SPDX-FileCopyrightText: 2022-2023 Espressif Systems (Shanghai) CO LTD
+# SPDX-License-Identifier: Unlicense OR CC0-1.0
+import re
+
+import pytest
+from pytest_embedded import Dut
+
+DEFAULT_TIMEOUT = 20
+TEST_SUBMENU_PATTERN_PYTEST = re.compile(rb'\s+\((\d+)\)\s+"([^"]+)"\r?\n')
+
+
+@pytest.mark.supported_targets
+@pytest.mark.temp_skip_ci(targets=['esp32c6', 'esp32h2'], reason='c6/h2 support TBD')
+@pytest.mark.generic
+@pytest.mark.parametrize(
+    'config',
+    [
+        'defaults',
+    ],
+    indirect=True,
+)
+def test_app_update(dut: Dut) -> None:
+    dut.run_all_single_board_cases(timeout=90)
+
+
+@pytest.mark.supported_targets
+@pytest.mark.temp_skip_ci(targets=['esp32c6', 'esp32h2'], reason='c6/h2 support TBD')
+@pytest.mark.generic
+@pytest.mark.parametrize(
+    'config',
+    [
+        'xip_psram',
+    ],
+    indirect=True,
+)
+def test_app_update_xip_psram(dut: Dut) -> None:
+    dut.run_all_single_board_cases(timeout=90)
+
+
+@pytest.mark.supported_targets
+@pytest.mark.temp_skip_ci(targets=['esp32c6', 'esp32h2'], reason='c6/h2 support TBD')
+@pytest.mark.generic
+@pytest.mark.parametrize(
+    'config',
+    [
+        'xip_psram_with_rom_impl',
+    ],
+    indirect=True,
+)
+def test_app_update_xip_psram_rom_impl(dut: Dut) -> None:
+    dut.run_all_single_board_cases(timeout=90)

components/app_update/test_apps/test_app_update/sdkconfig.ci.defaults

@@ -0,0 +1,2 @@
+# don't delete.
+# used for CI to compile a default config when 'sdkconfig.ci.xxxx' is exist

components/app_update/test_apps/test_app_update/sdkconfig.ci.xip_psram

@@ -1,3 +1,3 @@
-CONFIG_IDF_TARGET="esp32s3"
+CONFIG_SPIRAM=y
 CONFIG_SPIRAM_FETCH_INSTRUCTIONS=y
 CONFIG_SPIRAM_RODATA=y

components/app_update/test_apps/test_app_update/sdkconfig.ci.xip_psram_with_rom_impl

@@ -0,0 +1,4 @@
+CONFIG_SPIRAM=y
+CONFIG_SPIRAM_FETCH_INSTRUCTIONS=y
+CONFIG_SPIRAM_RODATA=y
+CONFIG_SPI_FLASH_ROM_IMPL=y

components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32s3

@@ -0,0 +1,2 @@
+CONFIG_IDF_TARGET="esp32s3"
+CONFIG_BOOTLOADER_NUM_PIN_APP_TEST=18

components/bootloader/Kconfig.projbuild

@@ -1115,6 +1115,44 @@ menu "Security features"
 
             If not set, the app does not care if the flash encryption eFuse bit is set or not.
 
+    config SECURE_FLASH_PSEUDO_ROUND_FUNC
+        bool "Permanently enable XTS-AES's pseudo rounds function"
+        default y
+        depends on SECURE_FLASH_ENCRYPTION_MODE_RELEASE && SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND
+        help
+            If set (default), the bootloader will permanently enable the XTS-AES peripheral's pseudo rounds function.
+            Note: Enabling this config would burn an efuse.
+
+    choice SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH
+        prompt "Strength of the pseudo rounds function"
+        depends on SECURE_FLASH_PSEUDO_ROUND_FUNC
+        default SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_LOW
+        help
+            The strength of the pseudo rounds functions can be configured to low, medium and high,
+            each denoting the values that would be stored in the efuses field.
+            By default the value to set to low.
+            You can configure the strength of the pseudo rounds functions according to your use cases,
+            for example, increasing the strength would provide higher security but would slow down the
+            flash encryption/decryption operations.
+            For more info regarding the performance impact, please checkout the pseudo round function section of the
+            security guide documentation.
+
+        config SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_LOW
+            bool "Low"
+
+        config SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_MEDIUM
+            bool "Medium"
+
+        config SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_HIGH
+            bool "High"
+    endchoice
+
+    config SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH
+        int
+        default 1 if SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_LOW
+        default 2 if SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_MEDIUM
+        default 3 if SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_HIGH
+
     config SECURE_ROM_DL_MODE_ENABLED
         bool
         default y if SOC_SUPPORTS_SECURE_DL_MODE && !SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT

components/bootloader_support/bootloader_flash/src/bootloader_flash.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -685,7 +685,7 @@ void bootloader_spi_flash_reset(void)
  ******************************************************************************/
 
 #define XMC_SUPPORT CONFIG_BOOTLOADER_FLASH_XMC_SUPPORT
-#define XMC_VENDOR_ID 0x20
+#define XMC_VENDOR_ID_1 0x20
 
 #if BOOTLOADER_BUILD
 #define BOOTLOADER_FLASH_LOG(level, ...)    ESP_EARLY_LOG##level(TAG, ##__VA_ARGS__)
@@ -702,7 +702,7 @@ static IRAM_ATTR bool is_xmc_chip_strict(uint32_t rdid)
     uint32_t mfid = BYTESHIFT(rdid, 1);
     uint32_t cpid = BYTESHIFT(rdid, 0);
 
-    if (vendor_id != XMC_VENDOR_ID) {
+    if (vendor_id != XMC_VENDOR_ID_1) {
         return false;
     }
 
@@ -735,7 +735,7 @@ esp_err_t IRAM_ATTR bootloader_flash_xmc_startup(void)
     // Check the Manufacturer ID in SFDP registers (JEDEC standard). If not XMC chip, no need to run the flow
     const int sfdp_mfid_addr = 0x10;
     uint8_t mf_id = (bootloader_flash_read_sfdp(sfdp_mfid_addr, 1) & 0xff);
-    if (mf_id != XMC_VENDOR_ID) {
+    if (mf_id != XMC_VENDOR_ID_1) {
         BOOTLOADER_FLASH_LOG(D, "non-XMC chip detected by SFDP Read (%02X), skip.", mf_id);
         return ESP_OK;
     }
@@ -767,7 +767,7 @@ esp_err_t IRAM_ATTR bootloader_flash_xmc_startup(void)
 static IRAM_ATTR bool is_xmc_chip(uint32_t rdid)
 {
     uint32_t vendor_id = (rdid >> 16) & 0xFF;
-    return (vendor_id == XMC_VENDOR_ID);
+    return (vendor_id == XMC_VENDOR_ID_1);
 }
 
 esp_err_t IRAM_ATTR bootloader_flash_xmc_startup(void)

components/bootloader_support/include/bootloader_memory_utils.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2010-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2010-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -27,7 +27,12 @@ extern "C" {
  */
 __attribute__((always_inline))
 inline static bool esp_dram_match_iram(void) {
-    return (SOC_DRAM_LOW == SOC_IRAM_LOW && SOC_DRAM_HIGH == SOC_IRAM_HIGH);
+    bool dram_match_iram = (SOC_DRAM_LOW == SOC_IRAM_LOW) &&
+                             (SOC_DRAM_HIGH == SOC_IRAM_HIGH);
+#if SOC_RTC_FAST_MEM_SUPPORTED
+        dram_match_iram &= (SOC_RTC_IRAM_LOW == SOC_RTC_DRAM_LOW);
+#endif
+    return dram_match_iram;
 }
 
 /**
@@ -81,6 +86,7 @@ __attribute__((always_inline))
 inline static bool esp_ptr_in_diram_iram(const void *p) {
 // TODO: IDF-5980 esp32c6 D/I RAM share the same address
 #if SOC_DIRAM_IRAM_LOW == SOC_DIRAM_DRAM_LOW
+    (void)p;
     return false;
 #else
     return ((intptr_t)p >= SOC_DIRAM_IRAM_LOW && (intptr_t)p < SOC_DIRAM_IRAM_HIGH);
@@ -96,9 +102,10 @@ inline static bool esp_ptr_in_diram_iram(const void *p) {
  */
 __attribute__((always_inline))
 inline static bool esp_ptr_in_rtc_iram_fast(const void *p) {
-#if SOC_RTC_FAST_MEM_SUPPORTED
+#if SOC_RTC_FAST_MEM_SUPPORTED && (SOC_RTC_IRAM_LOW != SOC_RTC_DRAM_LOW)
     return ((intptr_t)p >= SOC_RTC_IRAM_LOW && (intptr_t)p < SOC_RTC_IRAM_HIGH);
 #else
+    (void)p;
     return false;
 #endif
 }
@@ -115,6 +122,7 @@ inline static bool esp_ptr_in_rtc_dram_fast(const void *p) {
 #if SOC_RTC_FAST_MEM_SUPPORTED
     return ((intptr_t)p >= SOC_RTC_DRAM_LOW && (intptr_t)p < SOC_RTC_DRAM_HIGH);
 #else
+    (void)p;
     return false;
 #endif
 }
@@ -150,6 +158,21 @@ inline static void * esp_ptr_diram_dram_to_iram(const void *p) {
 #endif
 }
 
+/* Convert a RTC DRAM pointer to equivalent word address in RTC IRAM
+
+   - Address must be word aligned
+   - Address must pass esp_ptr_in_rtc_dram_fast() test, or result will be invalid pointer
+*/
+__attribute__((always_inline))
+inline static void * esp_ptr_rtc_dram_to_iram(const void *p) {
+    intptr_t ptr = (intptr_t)p;
+#if SOC_RTC_FAST_MEM_SUPPORTED && (SOC_RTC_IRAM_LOW != SOC_RTC_DRAM_LOW)
+    return (void *) ( SOC_RTC_IRAM_LOW + (ptr - SOC_RTC_DRAM_LOW) );
+#else
+    return (void *) ptr;
+#endif
+}
+
 /* Convert a D/IRAM IRAM pointer to equivalent word address in DRAM
 
    - Address must be word aligned

components/bootloader_support/src/esp32h2/bootloader_esp32h2.c

@@ -89,6 +89,8 @@ static inline void bootloader_hardware_init(void)
 {
     /* Enable analog i2c master clock */
     SET_PERI_REG_MASK(MODEM_LPCON_CLK_CONF_REG, MODEM_LPCON_CLK_I2C_MST_EN);
+    REGI2C_WRITE_MASK(I2C_BIAS, I2C_BIAS_DREG_0P8, 8);  // fix low temp issue, need to increase this internal voltage
+
 }
 
 static inline void bootloader_ana_reset_config(void)

components/bootloader_support/src/esp32h2/flash_encryption_secure_features.c

@@ -1,15 +1,18 @@
 /*
- * SPDX-FileCopyrightText: 2022-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
 
+#include <stdint.h>
 #include <strings.h>
 #include "esp_flash_encrypt.h"
 #include "esp_secure_boot.h"
 #include "esp_efuse.h"
 #include "esp_efuse_table.h"
 #include "esp_log.h"
+#include "hal/spi_flash_encrypted_ll.h"
+#include "soc/soc_caps.h"
 #include "sdkconfig.h"
 
 static __attribute__((unused)) const char *TAG = "flash_encrypt";
@@ -33,6 +36,14 @@ esp_err_t esp_flash_encryption_enable_secure_features(void)
 
     esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT);
 
+#if defined(CONFIG_SECURE_FLASH_ENCRYPTION_MODE_RELEASE) && defined(SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND)
+    if (spi_flash_encrypt_ll_is_pseudo_rounds_function_supported()) {
+        ESP_LOGI(TAG, "Enable XTS-AES pseudo rounds function...");
+        uint8_t xts_pseudo_level = CONFIG_SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH;
+        esp_efuse_write_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count);
+    }
+#endif
+
 #if defined(CONFIG_SECURE_BOOT_V2_ENABLED) && !defined(CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS)
     // This bit is set when enabling Secure Boot V2, but we can't enable it until this later point in the first boot
     // otherwise the Flash Encryption key cannot be read protected

components/bootloader_support/src/flash_encrypt.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -12,6 +12,9 @@
 #include "esp_flash_encrypt.h"
 #include "esp_secure_boot.h"
 #include "hal/efuse_hal.h"
+#include "hal/spi_flash_encrypted_ll.h"
+#include "hal/spi_flash_encrypt_hal.h"
+#include "soc/soc_caps.h"
 
 #if CONFIG_IDF_TARGET_ESP32
 #define CRYPT_CNT ESP_EFUSE_FLASH_CRYPT_CNT
@@ -211,6 +214,13 @@ void esp_flash_encryption_set_release_mode(void)
 #endif // CONFIG_SOC_FLASH_ENCRYPTION_XTS_AES_128_DERIVED
 #endif // !CONFIG_IDF_TARGET_ESP32
 
+#ifdef SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND
+    if (spi_flash_encrypt_ll_is_pseudo_rounds_function_supported()) {
+        uint8_t xts_pseudo_level = ESP_XTS_AES_PSEUDO_ROUNDS_LOW;
+        esp_efuse_write_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count);
+    }
+#endif
+
 #ifdef CONFIG_IDF_TARGET_ESP32
     esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_DIS_CACHE);
 #else
@@ -457,6 +467,17 @@ bool esp_flash_encryption_cfg_verify_release_mode(void)
     }
     result &= secure;
 
+#if SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND
+    if (spi_flash_encrypt_ll_is_pseudo_rounds_function_supported()) {
+        uint8_t xts_pseudo_level = 0;
+        esp_efuse_read_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count);
+        if (!xts_pseudo_level) {
+            result &= false;
+            ESP_LOGW(TAG, "Not enabled XTS-AES pseudo rounds function (set XTS_DPA_PSEUDO_LEVEL->1 or more)");
+        }
+    }
+#endif
+
     return result;
 }
 #endif // not CONFIG_IDF_TARGET_ESP32

components/bt/CMakeLists.txt

@@ -46,12 +46,20 @@ set(ble_mesh_include_dirs
     "esp_ble_mesh/api/core/include"
     "esp_ble_mesh/api/models/include"
     "esp_ble_mesh/api"
+)
+
+set(ble_mesh_v11_include_dirs
     "esp_ble_mesh/lib/include"
     "esp_ble_mesh/v1.1/api/core/include"
     "esp_ble_mesh/v1.1/api/models/include"
     "esp_ble_mesh/v1.1/btc/include"
 )
 
+if(CONFIG_IDF_DOC_BUILD)
+    list(APPEND ble_mesh_include_dirs
+                ${ble_mesh_v11_include_dirs})
+endif()
+
 set(bluedroid_include_dirs host/bluedroid/api/include/api)
 
 if(CONFIG_BT_CONTROLLER_ENABLED OR CONFIG_IDF_DOC_BUILD)
@@ -89,6 +97,9 @@ if(CONFIG_BT_ENABLED)
 
         elseif(CONFIG_IDF_TARGET_ESP32C2)
             list(APPEND srcs "controller/esp32c2/bt.c")
+            if(CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY)
+                list(APPEND srcs "controller/esp32c2/dummy.c")
+            endif()
             set(ldscripts "linker_esp32c2.lf")
 
         elseif(CONFIG_IDF_TARGET_ESP32C6)
@@ -533,34 +544,41 @@ if(CONFIG_BT_ENABLED)
                     "esp_ble_mesh/models/server/server_common.c"
                     "esp_ble_mesh/models/server/state_binding.c"
                     "esp_ble_mesh/models/server/state_transition.c"
-                    "esp_ble_mesh/models/server/time_scene_server.c"
-                    "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_agg_model_api.c"
-                    "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_brc_model_api.c"
-                    "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_cm_data_api.c"
-                    "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_df_model_api.c"
-                    "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_lcd_model_api.c"
-                    "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_odp_model_api.c"
-                    "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_prb_model_api.c"
-                    "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_rpr_model_api.c"
-                    "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_sar_model_api.c"
-                    "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_srpl_model_api.c"
-                    "esp_ble_mesh/v1.1/api/models/esp_ble_mesh_mbt_model_api.c"
-                    "esp_ble_mesh/v1.1/btc/btc_ble_mesh_agg_model.c"
-                    "esp_ble_mesh/v1.1/btc/btc_ble_mesh_brc_model.c"
-                    "esp_ble_mesh/v1.1/btc/btc_ble_mesh_df_model.c"
-                    "esp_ble_mesh/v1.1/btc/btc_ble_mesh_lcd_model.c"
-                    "esp_ble_mesh/v1.1/btc/btc_ble_mesh_mbt_model.c"
-                    "esp_ble_mesh/v1.1/btc/btc_ble_mesh_odp_model.c"
-                    "esp_ble_mesh/v1.1/btc/btc_ble_mesh_prb_model.c"
-                    "esp_ble_mesh/v1.1/btc/btc_ble_mesh_rpr_model.c"
-                    "esp_ble_mesh/v1.1/btc/btc_ble_mesh_sar_model.c"
-                    "esp_ble_mesh/v1.1/btc/btc_ble_mesh_srpl_model.c"
-                    "esp_ble_mesh/lib/ext.c")
+                    "esp_ble_mesh/models/server/time_scene_server.c")
+        if(CONFIG_BLE_MESH_V11_SUPPORT)
+            list(APPEND include_dirs ${ble_mesh_v11_include_dirs})
 
-        if(CONFIG_BLE_MESH_SAR_ENHANCEMENT)
-            list(APPEND srcs "esp_ble_mesh/core/transport.enh.c")
+            list(APPEND srcs
+                        "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_agg_model_api.c"
+                        "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_brc_model_api.c"
+                        "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_cm_data_api.c"
+                        "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_df_model_api.c"
+                        "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_lcd_model_api.c"
+                        "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_odp_model_api.c"
+                        "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_prb_model_api.c"
+                        "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_rpr_model_api.c"
+                        "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_sar_model_api.c"
+                        "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_srpl_model_api.c"
+                        "esp_ble_mesh/v1.1/api/models/esp_ble_mesh_mbt_model_api.c"
+                        "esp_ble_mesh/v1.1/btc/btc_ble_mesh_agg_model.c"
+                        "esp_ble_mesh/v1.1/btc/btc_ble_mesh_brc_model.c"
+                        "esp_ble_mesh/v1.1/btc/btc_ble_mesh_df_model.c"
+                        "esp_ble_mesh/v1.1/btc/btc_ble_mesh_lcd_model.c"
+                        "esp_ble_mesh/v1.1/btc/btc_ble_mesh_mbt_model.c"
+                        "esp_ble_mesh/v1.1/btc/btc_ble_mesh_odp_model.c"
+                        "esp_ble_mesh/v1.1/btc/btc_ble_mesh_prb_model.c"
+                        "esp_ble_mesh/v1.1/btc/btc_ble_mesh_rpr_model.c"
+                        "esp_ble_mesh/v1.1/btc/btc_ble_mesh_sar_model.c"
+                        "esp_ble_mesh/v1.1/btc/btc_ble_mesh_srpl_model.c"
+                        "esp_ble_mesh/lib/ext.c")
+            if(CONFIG_BLE_MESH_SAR_ENHANCEMENT)
+                list(APPEND srcs "esp_ble_mesh/core/transport.enh.c")
+            else()
+                list(APPEND srcs "esp_ble_mesh/core/transport.c")
+            endif()
         else()
-            list(APPEND srcs "esp_ble_mesh/core/transport.c")
+            list(APPEND srcs
+                        "esp_ble_mesh/core/transport.c")
         endif()
     endif()
 
@@ -726,6 +744,7 @@ if(CONFIG_BT_ENABLED)
                     "host/nimble/nimble/nimble/host/store/config/src/ble_store_nvs.c"
                     "host/nimble/nimble/nimble/host/src/ble_gattc_cache.c"
                     "host/nimble/nimble/nimble/host/src/ble_gattc_cache_conn.c"
+                    "host/nimble/nimble/nimble/host/src/ble_eatt.c"
                 )
 
             if(CONFIG_BT_CONTROLLER_DISABLED AND CONFIG_BT_NIMBLE_TRANSPORT_UART)
@@ -857,13 +876,29 @@ if(CONFIG_BT_ENABLED)
     elseif(CONFIG_IDF_TARGET_ESP32C3)
         target_link_directories(${COMPONENT_LIB} INTERFACE
                 "${CMAKE_CURRENT_LIST_DIR}/controller/lib_esp32c3_family/esp32c3")
-        target_link_libraries(${COMPONENT_LIB} PUBLIC btdm_app)
+        if(CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY)
+            target_link_libraries(${COMPONENT_LIB} PUBLIC btdm_app_flash)
+        else()
+            target_link_libraries(${COMPONENT_LIB} PUBLIC btdm_app)
+        endif()
     elseif(CONFIG_IDF_TARGET_ESP32S3)
         target_link_directories(${COMPONENT_LIB} INTERFACE
                 "${CMAKE_CURRENT_LIST_DIR}/controller/lib_esp32c3_family/esp32s3")
-        target_link_libraries(${COMPONENT_LIB} PUBLIC btdm_app)
+        if(CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY)
+            target_link_libraries(${COMPONENT_LIB} PUBLIC btdm_app_flash)
+        else()
+            target_link_libraries(${COMPONENT_LIB} PUBLIC btdm_app)
+        endif()
     elseif(CONFIG_BT_CONTROLLER_ENABLED)
-        add_prebuilt_library(libble_app "controller/lib_${target}/${target}-bt-lib/libble_app.a")
+        if(CONFIG_IDF_TARGET_ESP32C6)
+            add_prebuilt_library(libble_app "controller/lib_${target}/${target}-bt-lib/esp32c6/libble_app.a")
+        else()
+            if(CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY AND CONFIG_IDF_TARGET_ESP32C2)
+                add_prebuilt_library(libble_app "controller/lib_${target}/${target}-bt-lib/libble_app_flash.a")
+            else()
+                add_prebuilt_library(libble_app "controller/lib_${target}/${target}-bt-lib/libble_app.a")
+            endif()
+        endif()
         target_link_libraries(${COMPONENT_LIB} PRIVATE libble_app)
     endif()
 
@@ -877,7 +912,7 @@ if(CONFIG_BT_ENABLED)
     target_compile_options(${COMPONENT_LIB} PRIVATE "-Wno-format")
 endif()
 
-if(CONFIG_BLE_MESH)
+if(CONFIG_BLE_MESH_V11_SUPPORT)
     if(CONFIG_IDF_TARGET_ESP32)
         add_prebuilt_library(ble_mesh "esp_ble_mesh/lib/lib/esp32/libble_mesh.a")
         target_link_libraries(${COMPONENT_LIB} PRIVATE ble_mesh)

components/bt/common/btc/core/btc_task.c

@@ -69,6 +69,12 @@
 #include "btc_ble_mesh_prov.h"
 #include "btc_ble_mesh_health_model.h"
 #include "btc_ble_mesh_config_model.h"
+#include "btc_ble_mesh_generic_model.h"
+#include "btc_ble_mesh_lighting_model.h"
+#include "btc_ble_mesh_sensor_model.h"
+#include "btc_ble_mesh_time_scene_model.h"
+#if CONFIG_BLE_MESH_V11_SUPPORT
+#include "btc_ble_mesh_mbt_model.h"
 #include "btc_ble_mesh_agg_model.h"
 #include "btc_ble_mesh_brc_model.h"
 #include "btc_ble_mesh_df_model.h"
@@ -78,11 +84,7 @@
 #include "btc_ble_mesh_rpr_model.h"
 #include "btc_ble_mesh_sar_model.h"
 #include "btc_ble_mesh_srpl_model.h"
-#include "btc_ble_mesh_generic_model.h"
-#include "btc_ble_mesh_lighting_model.h"
-#include "btc_ble_mesh_sensor_model.h"
-#include "btc_ble_mesh_time_scene_model.h"
-#include "btc_ble_mesh_mbt_model.h"
+#endif /* CONFIG_BLE_MESH_V11_SUPPORT */
 #endif /* #if CONFIG_BLE_MESH */
 
 #define BTC_TASK_PINNED_TO_CORE         (TASK_PINNED_TO_CORE)
@@ -295,8 +297,8 @@ static bt_status_t btc_task_post(btc_msg_t *msg, uint32_t timeout)
 /**
  * transfer an message to another module in the different task.
  * @param  msg       message
- * @param  arg       paramter
- * @param  arg_len   length of paramter
+ * @param  arg       parameter
+ * @param  arg_len   length of parameter
  * @param  copy_func deep copy function
  * @param  free_func deep free function
  * @return           BT_STATUS_SUCCESS: success
@@ -342,7 +344,7 @@ bt_status_t btc_transfer_context(btc_msg_t *msg, void *arg, int arg_len, btc_arg
 }
 
 /**
- * transfer an message to another module in tha same task.
+ * transfer an message to another module in the same task.
  * @param  msg       message
  * @return           BT_STATUS_SUCCESS: success
  *                   others: fail
@@ -380,7 +382,7 @@ static void btc_deinit_mem(void) {
         btc_profile_cb_tab = NULL;
     }
 
-#if (BLE_INCLUDED == TRUE)
+#if (BLE_42_FEATURE_SUPPORT == TRUE)
     if (gl_bta_adv_data_ptr) {
         osi_free(gl_bta_adv_data_ptr);
         gl_bta_adv_data_ptr = NULL;
@@ -390,7 +392,7 @@ static void btc_deinit_mem(void) {
         osi_free(gl_bta_scan_rsp_data_ptr);
         gl_bta_scan_rsp_data_ptr = NULL;
     }
-#endif  ///BLE_INCLUDED == TRUE
+#endif // BLE_42_FEATURE_SUPPORT
 
 #if GATTS_INCLUDED == TRUE && GATT_DYNAMIC_MEMORY == TRUE
     if (btc_creat_tab_env_ptr) {
@@ -442,7 +444,8 @@ static bt_status_t btc_init_mem(void) {
     }
     memset((void *)btc_profile_cb_tab, 0, sizeof(void *) * BTC_PID_NUM);
 
-#if (BLE_INCLUDED == TRUE)
+#if BTC_DYNAMIC_MEMORY == TRUE
+#if (BLE_42_FEATURE_SUPPORT == TRUE)
     if ((gl_bta_adv_data_ptr = (tBTA_BLE_ADV_DATA *)osi_malloc(sizeof(tBTA_BLE_ADV_DATA))) == NULL) {
         goto error_exit;
     }
@@ -452,7 +455,8 @@ static bt_status_t btc_init_mem(void) {
         goto error_exit;
     }
     memset((void *)gl_bta_scan_rsp_data_ptr, 0, sizeof(tBTA_BLE_ADV_DATA));
-#endif  ///BLE_INCLUDED == TRUE
+#endif // (BLE_42_FEATURE_SUPPORT == TRUE)
+#endif // BTC_DYNAMIC_MEMORY == TRUE
 
 #if GATTS_INCLUDED == TRUE && GATT_DYNAMIC_MEMORY == TRUE
     if ((btc_creat_tab_env_ptr = (esp_btc_creat_tab_t *)osi_malloc(sizeof(esp_btc_creat_tab_t))) == NULL) {

components/bt/common/btc/profile/esp/blufi/bluedroid_host/esp_blufi.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -160,20 +160,31 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
         if (p_data->req_data.p_data->write_req.is_prep) {
             tBTA_GATT_STATUS status = GATT_SUCCESS;
 
-            if (blufi_env.prepare_buf == NULL) {
-                blufi_env.prepare_buf = osi_malloc(BLUFI_PREPAIR_BUF_MAX_SIZE);
-                blufi_env.prepare_len = 0;
+            do {
+                if (p_data->req_data.p_data->write_req.offset > BLUFI_PREPARE_BUF_MAX_SIZE) {
+                   status = ESP_GATT_INVALID_OFFSET;
+                   break;
+                }
+
+                if ((p_data->req_data.p_data->write_req.offset + p_data->req_data.p_data->write_req.len) > BLUFI_PREPARE_BUF_MAX_SIZE) {
+                   status = ESP_GATT_INVALID_ATTR_LEN;
+                   break;
+                }
+
                 if (blufi_env.prepare_buf == NULL) {
-                    BLUFI_TRACE_ERROR("Blufi prep no mem\n");
-                    status = GATT_NO_RESOURCES;
+                    if (p_data->req_data.p_data->write_req.offset != 0) {
+                        status = GATT_INVALID_OFFSET;
+                        break;
+                    }
+                    blufi_env.prepare_buf = osi_malloc(BLUFI_PREPARE_BUF_MAX_SIZE);
+                    blufi_env.prepare_len = 0;
+                    if (blufi_env.prepare_buf == NULL) {
+                        BLUFI_TRACE_ERROR("Blufi prep no mem\n");
+                        status = GATT_NO_RESOURCES;
+                        break;
+                    }
                 }
-            } else {
-                if (p_data->req_data.p_data->write_req.offset > BLUFI_PREPAIR_BUF_MAX_SIZE) {
-                    status = GATT_INVALID_OFFSET;
-                } else if ((p_data->req_data.p_data->write_req.offset + p_data->req_data.p_data->write_req.len) > BLUFI_PREPAIR_BUF_MAX_SIZE) {
-                    status = GATT_INVALID_ATTR_LEN;
-                }
-            }
+            } while (0);
 
             memset(&rsp, 0, sizeof(tGATTS_RSP));
             rsp.attr_value.handle = p_data->req_data.p_data->write_req.handle;

components/bt/common/btc/profile/esp/blufi/blufi_prf.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -95,7 +95,29 @@ void btc_blufi_report_error(esp_blufi_error_state_t state)
 
 void btc_blufi_recv_handler(uint8_t *data, int len)
 {
+    if (len < sizeof(struct blufi_hdr)) {
+        BTC_TRACE_ERROR("%s invalid data length: %d", __func__, len);
+        btc_blufi_report_error(ESP_BLUFI_DATA_FORMAT_ERROR);
+        return;
+    }
+
     struct blufi_hdr *hdr = (struct blufi_hdr *)data;
+
+    // Verify if the received data length matches the expected length based on the BLUFI protocol
+    int target_data_len;
+
+    if (BLUFI_FC_IS_CHECK(hdr->fc)) {
+        target_data_len = hdr->data_len + 4 + 2; // Data + (Type + Frame Control + Sequence Number + Data Length) + Checksum
+    } else {
+        target_data_len = hdr->data_len + 4; // Data + (Type + Frame Control + Sequence Number + Data Length)
+    }
+
+    if (len != target_data_len) {
+        BTC_TRACE_ERROR("%s: Invalid data length: %d, expected: %d", __func__, len, target_data_len);
+        btc_blufi_report_error(ESP_BLUFI_DATA_FORMAT_ERROR);
+        return;
+    }
+
     uint16_t checksum, checksum_pkt;
     int ret;
 

components/bt/common/btc/profile/esp/blufi/include/blufi_int.h

@@ -36,7 +36,9 @@ typedef struct {
     UINT32                  trans_id;
     UINT8                   congest;
     UINT16                  frag_size;
+// Deprecated: This macro will be removed in the future
 #define BLUFI_PREPAIR_BUF_MAX_SIZE 1024
+#define BLUFI_PREPARE_BUF_MAX_SIZE 1024
     uint8_t                 *prepare_buf;
     int                     prepare_len;
     /* Control reference */

components/bt/common/btc/profile/esp/blufi/include/esp_blufi.h

@@ -44,6 +44,7 @@ void esp_blufi_gatt_svr_register_cb(struct ble_gatt_register_ctxt *ctxt, void *a
 
 /* Initialise gatt server */
 int esp_blufi_gatt_svr_init(void);
+int esp_blufi_gatt_svr_deinit(void);
 void esp_blufi_btc_init(void);
 void esp_blufi_btc_deinit(void);
 #endif

components/bt/common/btc/profile/esp/blufi/nimble_host/esp_blufi.c

@@ -240,6 +240,32 @@ static void init_gatt_values(void)
 
 }
 
+static void deinit_gatt_values(void)
+{
+    int i = 0;
+    const struct ble_gatt_svc_def *svc;
+    const struct ble_gatt_chr_def *chr;
+    const struct ble_gatt_dsc_def *dsc;
+
+    for (svc = gatt_svr_svcs; svc && svc->uuid; svc++) {
+        for (chr = svc->characteristics; chr && chr->uuid; chr++) {
+            if (i < SERVER_MAX_VALUES && gatt_values[i].buf != NULL) {
+                os_mbuf_free(gatt_values[i].buf);  /* Free the buffer */
+                gatt_values[i].buf = NULL;         /* Nullify the pointer to avoid dangling references */
+            }
+            ++i;
+
+            for (dsc = chr->descriptors; dsc && dsc->uuid; dsc++) {
+                if (i < SERVER_MAX_VALUES && gatt_values[i].buf != NULL) {
+                    os_mbuf_free(gatt_values[i].buf);  /* Free the buffer */
+                    gatt_values[i].buf = NULL;         /* Nullify the pointer to avoid dangling references */
+                }
+                ++i;
+            }
+        }
+    }
+}
+
 int esp_blufi_gatt_svr_init(void)
 {
     int rc;
@@ -260,6 +286,18 @@ int esp_blufi_gatt_svr_init(void)
     return 0;
 }
 
+int esp_blufi_gatt_svr_deinit(void)
+{
+    deinit_gatt_values();
+
+    ble_gatts_free_svcs();
+    /* Deinitialize BLE GATT and GAP services */
+    ble_svc_gatt_deinit();
+    ble_svc_gap_deinit();
+
+    return 0;
+}
+
 static int
 esp_blufi_gap_event(struct ble_gap_event *event, void *arg)
 {
@@ -442,8 +480,10 @@ uint8_t esp_blufi_init(void)
 void esp_blufi_deinit(void)
 {
     blufi_env.enabled = false;
-    btc_msg_t msg;
     esp_blufi_cb_param_t param;
+    btc_msg_t msg;
+    memset (&msg, 0x0, sizeof (msg));
+    msg.sig = BTC_SIG_API_CB;
     msg.pid = BTC_PID_BLUFI;
     msg.act = ESP_BLUFI_EVENT_DEINIT_FINISH;
     param.deinit_finish.state = ESP_BLUFI_DEINIT_OK;

components/bt/common/hci_log/bt_hci_log.c

@@ -305,19 +305,27 @@ void bt_hci_log_data_show(bt_hci_log_t *p_hci_log_ctl)
 
     osi_mutex_unlock(&mutex_lock);
 }
+static bool enable_hci_log_flag = true;
+void bt_hci_log_record_hci_enable(bool enable)
+{
+    enable_hci_log_flag = enable;
+}
 
 esp_err_t IRAM_ATTR bt_hci_log_record_hci_data(uint8_t data_type, uint8_t *data, uint8_t data_len)
 {
+    if (!enable_hci_log_flag) return ESP_OK;
     return bt_hci_log_record_data(&g_bt_hci_log_data_ctl, NULL, data_type, data, data_len);
 }
 
 esp_err_t IRAM_ATTR bt_hci_log_record_custom_data(char *string, uint8_t *data, uint8_t data_len)
 {
+    if (!enable_hci_log_flag) return ESP_OK;
     return bt_hci_log_record_data(&g_bt_hci_log_data_ctl, string, HCI_LOG_DATA_TYPE_SELF_DEFINE, data, data_len);
 }
 
 esp_err_t IRAM_ATTR bt_hci_log_record_hci_adv(uint8_t data_type, uint8_t *data, uint8_t data_len)
 {
+    if (!enable_hci_log_flag) return ESP_OK;
     return bt_hci_log_record_data(&g_bt_hci_log_adv_ctl, NULL, data_type, data, data_len);
 }
 

components/bt/common/osi/allocator.c

@@ -241,5 +241,8 @@ void *osi_calloc_func(size_t size)
 
 void osi_free_func(void *ptr)
 {
+#if HEAP_MEMORY_DEBUG
+    osi_mem_dbg_clean(ptr, __func__, __LINE__);
+#endif
     free(ptr);
 }

components/bt/common/osi/include/osi/allocator.h

@@ -29,6 +29,15 @@ void *osi_malloc_func(size_t size);
 void *osi_calloc_func(size_t size);
 void osi_free_func(void *ptr);
 
+// Memory alloc function without print and assertion
+#if HEAP_ALLOCATION_FROM_SPIRAM_FIRST
+#define osi_malloc_base(size)             heap_caps_malloc_prefer(size, 2, MALLOC_CAP_DEFAULT|MALLOC_CAP_SPIRAM, MALLOC_CAP_DEFAULT|MALLOC_CAP_INTERNAL)
+#define osi_calloc_base(size)             heap_caps_calloc_prefer(1, size, 2, MALLOC_CAP_DEFAULT|MALLOC_CAP_SPIRAM, MALLOC_CAP_DEFAULT|MALLOC_CAP_INTERNAL)
+#else
+#define osi_malloc_base(size)             malloc((size))
+#define osi_calloc_base(size)             calloc(1, (size))
+#endif /* #if HEAP_ALLOCATION_FROM_SPIRAM_FIRST */
+
 #if HEAP_MEMORY_DEBUG
 
 void osi_mem_dbg_init(void);
@@ -41,13 +50,10 @@ void osi_men_dbg_set_section_start(uint8_t index);
 void osi_men_dbg_set_section_end(uint8_t index);
 uint32_t osi_mem_dbg_get_max_size_section(uint8_t index);
 
-#if HEAP_ALLOCATION_FROM_SPIRAM_FIRST
 #define osi_malloc(size)                                \
 ({                                                      \
     void *p;                                            \
-    p = heap_caps_malloc_prefer(size, 2,                \
-        MALLOC_CAP_DEFAULT|MALLOC_CAP_SPIRAM,           \
-        MALLOC_CAP_DEFAULT|MALLOC_CAP_INTERNAL);        \
+    p = osi_malloc_base(size);                          \
     osi_mem_dbg_record(p, size, __func__, __LINE__);    \
     (void *)p;                                          \
 })
@@ -55,34 +61,11 @@ uint32_t osi_mem_dbg_get_max_size_section(uint8_t index);
 #define osi_calloc(size)                                \
 ({                                                      \
     void *p;                                            \
-    p = heap_caps_calloc_prefer(1, size, 2,             \
-        MALLOC_CAP_DEFAULT|MALLOC_CAP_SPIRAM,           \
-        MALLOC_CAP_DEFAULT|MALLOC_CAP_INTERNAL);        \
+    p = osi_calloc_base(size);                          \
     osi_mem_dbg_record(p, size, __func__, __LINE__);    \
     (void *)p;                                          \
 })
 
-#else
-
-#define osi_malloc(size)                                \
-({                                                      \
-    void *p;                                            \
-    p = malloc((size));                                 \
-    osi_mem_dbg_record(p, size, __func__, __LINE__);    \
-    (void *)p;                                          \
-})
-
-#define osi_calloc(size)                                \
-({                                                      \
-    void *p;                                            \
-    p = calloc(1, (size));                              \
-    osi_mem_dbg_record(p, size, __func__, __LINE__);    \
-    (void *)p;                                          \
-})
-
-#endif /* #if HEAP_ALLOCATION_FROM_SPIRAM_FIRST */
-
-
 #if 0
 #define osi_malloc(size)                                \
 do {                                                    \
@@ -122,15 +105,6 @@ do {                                                    \
 
 #else
 
-// Memory alloc function without print and assertion
-#if HEAP_ALLOCATION_FROM_SPIRAM_FIRST
-#define osi_malloc_base(size)             heap_caps_malloc_prefer(size, 2, MALLOC_CAP_DEFAULT|MALLOC_CAP_SPIRAM, MALLOC_CAP_DEFAULT|MALLOC_CAP_INTERNAL)
-#define osi_calloc_base(size)             heap_caps_calloc_prefer(1, size, 2, MALLOC_CAP_DEFAULT|MALLOC_CAP_SPIRAM, MALLOC_CAP_DEFAULT|MALLOC_CAP_INTERNAL)
-#else
-#define osi_malloc_base(size)             malloc((size))
-#define osi_calloc_base(size)             calloc(1, (size))
-#endif /* #if HEAP_ALLOCATION_FROM_SPIRAM_FIRST */
-
 // Memory alloc function with print and assertion when fails
 #define osi_malloc(size)                  osi_malloc_func((size))
 #define osi_calloc(size)                  osi_calloc_func((size))

components/bt/controller/esp32/Kconfig.in

@@ -262,10 +262,10 @@ menu "MODEM SLEEP Options"
                 the bluetooth low power clock source.
 
         config BTDM_CTRL_LPCLK_SEL_EXT_32K_XTAL
-            bool "External 32kHz crystal"
-            depends on RTC_CLK_SRC_EXT_CRYS
+            bool "External 32kHz crystal/oscillator"
+            depends on RTC_CLK_SRC_EXT_CRYS || RTC_CLK_SRC_EXT_OSC
             help
-                External 32kHz crystal has a nominal frequency of 32.768kHz and provides good frequency
+                External 32kHz crystal/oscillator has a nominal frequency of 32.768kHz and provides good frequency
                 stability. If used as Bluetooth low power clock, External 32kHz can support Bluetooth
                 modem sleep to be used with both DFS and light sleep.
     endchoice
@@ -406,6 +406,15 @@ config BTDM_CTRL_SCAN_BACKOFF_UPPERLIMITMAX
         minimize collision of scan request PDUs from nultiple scanners. If scan backoff is disabled, in active
         scanning, scan request PDU will be sent every time when HW receives scannable ADV PDU.
 
+config BTDM_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
+    bool "Enable enhanced Access Address check in CONNECT_IND"
+    default n
+    help
+        Enabling this option will add stricter verification of the Access Address in the CONNECT_IND PDU.
+        This improves security by ensuring that only connection requests with valid Access Addresses are accepted.
+        If disabled, only basic checks are applied, improving compatibility.
+
+
 config BTDM_BLE_ADV_REPORT_FLOW_CTRL_SUPP
     bool "BLE adv report flow control supported"
     depends on (BTDM_CTRL_MODE_BTDM || BTDM_CTRL_MODE_BLE_ONLY)
@@ -440,6 +449,46 @@ config BTDM_BLE_ADV_REPORT_DISCARD_THRSHOLD
         If you set `BTDM_BLE_ADV_REPORT_DISCARD_THRSHOLD` to a small value or printf every adv lost event, it
         may cause adv packets lost more.
 
+menu "BLE disconnect when instant passed"
+    config BTDM_BLE_LLCP_CONN_UPDATE
+        bool "BLE ACL connection update procedure"
+        depends on (BTDM_CTRL_MODE_BLE_ONLY || BTDM_CTRL_MODE_BTDM)
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when instant passed during connection update procedure.
+
+    config BTDM_BLE_LLCP_CHAN_MAP_UPDATE
+        bool "BLE ACL channel map update procedure"
+        depends on (BTDM_CTRL_MODE_BLE_ONLY || BTDM_CTRL_MODE_BTDM)
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when instant passed in channel map update procedure.
+endmenu
+
+config BTDM_BLE_CHAN_ASS_EN
+    bool "Enable channel assessment"
+    depends on (BTDM_CTRL_MODE_BLE_ONLY || BTDM_CTRL_MODE_BTDM)
+    default y
+    help
+        If this option is enabled, The Controller will records the communication quality
+        for each channel and then start a timer to check and update the channel map every 4 seconds.
+
+config BTDM_BLE_PING_EN
+    bool "Enable LE Ping procedure"
+    depends on (BTDM_CTRL_MODE_BTDM || BTDM_CTRL_MODE_BLE_ONLY)
+    default y
+    help
+        If this option is disabled, The Controller will not start the LE authenticated payload timer.
+        This option is used for some compatibility problems related to LE ping procedure.
+
+config BTDM_BLE_VS_QA_SUPPORT
+    bool "BLE vendor HCI QA support"
+    depends on (BTDM_CTRL_MODE_BTDM || BTDM_CTRL_MODE_BLE_ONLY)
+    default n
+    help
+        This enables BLE vendor HCI command and event for QA.
 
 config BTDM_RESERVE_DRAM
     hex

components/bt/controller/esp32/bt.c

@@ -244,6 +244,7 @@ extern uint32_t _bt_controller_data_end;
 extern void config_bt_funcs_reset(void);
 extern void config_ble_funcs_reset(void);
 extern void config_btdm_funcs_reset(void);
+extern void config_ble_vs_qa_funcs_reset(void);
 
 /* Local Function Declare
  *********************************************************************
@@ -1341,7 +1342,8 @@ static esp_err_t esp_bt_controller_rom_mem_release(esp_bt_mode_t mode)
 
     //already released
     if (!(mode & btdm_dram_available_region[0].mode)) {
-        return ESP_ERR_INVALID_STATE;
+        ESP_LOGW(BTDM_LOG_TAG, "%s already released, mode %d",__func__, mode);
+        return ESP_OK;
     }
 
     for (int i = 0; i < sizeof(btdm_dram_available_region)/sizeof(btdm_dram_available_region_t); i++) {
@@ -1548,6 +1550,7 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
     btdm_controller_mem_init();
 
     periph_module_enable(PERIPH_BT_MODULE);
+    periph_module_reset(PERIPH_BT_MODULE);
 
 #ifdef CONFIG_PM_ENABLE
     s_btdm_allow_light_sleep = false;
@@ -1634,7 +1637,10 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
 
     btdm_cfg_mask = btdm_config_mask_load();
 
-    if (btdm_controller_init(btdm_cfg_mask, cfg) != 0) {
+    err = btdm_controller_init(btdm_cfg_mask, cfg);
+
+    if (err != 0) {
+        ESP_LOGE(BTDM_LOG_TAG, "%s %d\n",__func__,err);
         err = ESP_ERR_NO_MEM;
         goto error;
     }
@@ -1738,6 +1744,10 @@ static void patch_apply(void)
 #ifndef CONFIG_BTDM_CTRL_MODE_BR_EDR_ONLY
     config_ble_funcs_reset();
 #endif
+
+#ifdef CONFIG_BTDM_BLE_VS_QA_SUPPORT
+    config_ble_vs_qa_funcs_reset();
+#endif
 }
 
 esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
@@ -1924,7 +1934,7 @@ esp_err_t esp_bredr_sco_datapath_set(esp_sco_data_path_t data_path)
     return ESP_OK;
 }
 
-esp_err_t esp_ble_scan_dupilcate_list_flush(void)
+esp_err_t esp_ble_scan_duplicate_list_flush(void)
 {
     if (btdm_controller_status != ESP_BT_CONTROLLER_STATUS_ENABLED) {
         return ESP_ERR_INVALID_STATE;
@@ -1933,6 +1943,11 @@ esp_err_t esp_ble_scan_dupilcate_list_flush(void)
     return ESP_OK;
 }
 
+esp_err_t esp_ble_scan_dupilcate_list_flush(void)
+{
+    return esp_ble_scan_duplicate_list_flush();
+}
+
 /**
  * This function re-write controller's function,
  * As coredump can not show parameters in function which is in a .a file.

components/bt/controller/esp32c2/Kconfig.in

@@ -109,86 +109,100 @@ menuconfig BT_LE_50_FEATURE_SUPPORT
     help
         Enable BLE 5 feature
 
-config BT_LE_LL_CFG_FEAT_LE_2M_PHY
-    bool "Enable 2M Phy"
-    depends on BT_LE_50_FEATURE_SUPPORT
-    default y
-    help
-        Enable 2M-PHY
-
-config BT_LE_LL_CFG_FEAT_LE_CODED_PHY
-    bool "Enable coded Phy"
-    depends on BT_LE_50_FEATURE_SUPPORT
-    default y
-    help
-        Enable coded-PHY
-
-config BT_LE_EXT_ADV
-    bool "Enable extended advertising"
-    depends on BT_LE_50_FEATURE_SUPPORT
-    default y
-    help
-        Enable this option to do extended advertising. Extended advertising
-        will be supported from BLE 5.0 onwards.
-
-if BT_LE_EXT_ADV
-    config BT_LE_MAX_EXT_ADV_INSTANCES
-        int "Maximum number of extended advertising instances."
-        range 0 4
-        default 1
-        depends on BT_LE_EXT_ADV
-        help
-            Change this option to set maximum number of extended advertising
-            instances. Minimum there is always one instance of
-            advertising. Enter how many more advertising instances you
-            want.
-            Each extended advertising instance will take about 0.5k DRAM.
-
-    config BT_LE_EXT_ADV_MAX_SIZE
-        int "Maximum length of the advertising data."
-        range 0 1650
-        default 1650
-        depends on BT_LE_EXT_ADV
-        help
-            Defines the length of the extended adv data. The value should not
-            exceed 1650.
-
-    config BT_LE_ENABLE_PERIODIC_ADV
-        bool "Enable periodic advertisement."
-        default y
-        depends on BT_LE_EXT_ADV
-        help
-            Enable this option to start periodic advertisement.
-
-    config BT_LE_PERIODIC_ADV_SYNC_TRANSFER
-        bool "Enable Transfer Sync Events"
-        depends on BT_LE_ENABLE_PERIODIC_ADV
+if BT_LE_50_FEATURE_SUPPORT
+    config BT_LE_LL_CFG_FEAT_LE_2M_PHY
+        bool "Enable 2M Phy"
+        depends on BT_LE_50_FEATURE_SUPPORT
         default y
         help
-            This enables controller transfer periodic sync events to host
+            Enable 2M-PHY
 
+    config BT_LE_LL_CFG_FEAT_LE_CODED_PHY
+        bool "Enable coded Phy"
+        depends on BT_LE_50_FEATURE_SUPPORT
+        default y
+        help
+            Enable coded-PHY
+
+    config BT_LE_EXT_ADV
+        bool "Enable extended advertising"
+        depends on BT_LE_50_FEATURE_SUPPORT
+        default y
+        help
+            Enable this option to do extended advertising. Extended advertising
+            will be supported from BLE 5.0 onwards.
+
+    if BT_LE_EXT_ADV
+        config BT_LE_MAX_EXT_ADV_INSTANCES
+            int "Maximum number of extended advertising instances."
+            range 0 4
+            default 1
+            depends on BT_LE_EXT_ADV
+            help
+                Change this option to set maximum number of extended advertising
+                instances. Minimum there is always one instance of
+                advertising. Enter how many more advertising instances you
+                want.
+                Each extended advertising instance will take about 0.5k DRAM.
+
+        config BT_LE_EXT_ADV_MAX_SIZE
+            int "Maximum length of the advertising data."
+            range 0 1650
+            default 1650
+            depends on BT_LE_EXT_ADV
+            help
+                Defines the length of the extended adv data. The value should not
+                exceed 1650.
+
+        config BT_LE_ENABLE_PERIODIC_ADV
+            bool "Enable periodic advertisement."
+            default y
+            depends on BT_LE_EXT_ADV
+            help
+                Enable this option to start periodic advertisement.
+
+        config BT_LE_PERIODIC_ADV_SYNC_TRANSFER
+            bool "Enable Transfer Sync Events"
+            depends on BT_LE_ENABLE_PERIODIC_ADV
+            default y
+            help
+                This enables controller transfer periodic sync events to host
+    endif
+
+    config BT_LE_EXT_SCAN
+        bool "Enable extended scanning"
+        depends on BT_LE_50_FEATURE_SUPPORT && BT_LE_ROLE_OBSERVER_ENABLE
+        default y
+        help
+            Enable this option to do extended scanning.
+
+    config BT_LE_ENABLE_PERIODIC_SYNC
+        bool "Enable periodic sync"
+        default y
+        depends on BT_LE_EXT_SCAN
+        help
+            Enable this option to receive periodic advertisement.
+
+    if BT_LE_ENABLE_PERIODIC_SYNC
+        config BT_LE_MAX_PERIODIC_SYNCS
+            int "Maximum number of periodic advertising syncs"
+            range 0 3
+            default 1 if BT_LE_ENABLE_PERIODIC_ADV
+            default 0
+            help
+                Set this option to set the upper limit for number of periodic sync
+                connections. This should be less than maximum connections allowed by
+                controller.
+
+        config BT_LE_MAX_PERIODIC_ADVERTISER_LIST
+            int "Maximum number of periodic advertiser list"
+            range 1 5
+            default 5
+            help
+                Set this option to set the upper limit for number of periodic advertiser list.
+    endif
 endif
 
-config BT_LE_MAX_PERIODIC_SYNCS
-    int "Maximum number of periodic advertising syncs"
-    depends on BT_LE_50_FEATURE_SUPPORT && !BT_NIMBLE_ENABLED
-
-    range 0 3
-    default 1 if BT_LE_ENABLE_PERIODIC_ADV
-    default 0
-    help
-        Set this option to set the upper limit for number of periodic sync
-        connections. This should be less than maximum connections allowed by
-        controller.
-
-config BT_LE_MAX_PERIODIC_ADVERTISER_LIST
-    int "Maximum number of periodic advertiser list"
-    depends on BT_LE_50_FEATURE_SUPPORT && !BT_NIMBLE_ENABLED
-    range 1 5
-    default 5
-    help
-        Set this option to set the upper limit for number of periodic advertiser list.
-
 menu "Memory Settings"
     depends on !BT_NIMBLE_ENABLED
 
@@ -523,6 +537,10 @@ config BT_LE_TX_CCA_ENABLED
     help
         Enable CCA feature to cancel sending the packet if the signal power is stronger than CCA threshold.
 
+config BT_LE_DTM_ENABLED
+    bool "Enable Direct Test Mode (DTM) feature"
+    default n
+
 config BT_LE_CCA_RSSI_THRESH
     int "CCA RSSI threshold value"
     depends on BT_LE_TX_CCA_ENABLED
@@ -531,6 +549,10 @@ config BT_LE_CCA_RSSI_THRESH
     help
         Power threshold of CCA in unit of -1 dBm.
 
+config BT_LE_FEAT_LL_ENCRYPTION
+    bool "Enable controller ACL encryption"
+    default y
+
 config BT_LE_ROLE_CENTROL_ENABLE
     bool "Enable BLE Centrol role function"
     depends on !BT_NIMBLE_ENABLED
@@ -617,3 +639,31 @@ config BT_LE_DFT_TX_POWER_LEVEL_DBM_EFF
     default 18 if BT_LE_DFT_TX_POWER_LEVEL_P18
     default 20 if BT_LE_DFT_TX_POWER_LEVEL_P20
     default 0
+
+config BT_CTRL_RUN_IN_FLASH_ONLY
+    bool "Reduce BLE IRAM usage (READ DOCS FIRST) (EXPERIMENTAL)"
+    default n
+    help
+        Move most IRAM into flash. This will increase the usage of flash and reduce ble performance.
+        Because the code is moved to the flash, the execution speed of the code is reduced.
+        To have a small impact on performance, you need to enable flash suspend (SPI_FLASH_AUTO_SUSPEND).
+
+        - Only one Tx-Rx can be performed in each connection interval. Therefore, reduce the connection interval
+          as much as possible to improve the throughput. If you want higher connection performance, you can
+          enable BT_LE_PLACE_CONN_RELATED_INTO_IRAM to put the connection-related code into iram.
+        - For HCI_LE_Extended_Create_Connection command, only 1M phy's connection parameters will be applied.
+          Other phys' will be ignored.
+        - For extended scanning, we may be unable to receive the extended adv with 300us MAFS.
+
+config BT_LE_PLACE_CONN_RELATED_INTO_IRAM
+    bool "Place the connection-related code into IRAM"
+    depends on BT_CTRL_RUN_IN_FLASH_ONLY
+    default n
+
+config BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
+    bool "Enable enhanced Access Address check in CONNECT_IND"
+    default n
+    help
+        Enabling this option will add stricter verification of the Access Address in the CONNECT_IND PDU.
+        This improves security by ensuring that only connection requests with valid Access Addresses are accepted.
+        If disabled, only basic checks are applied, improving compatibility.

components/bt/controller/esp32c2/bt.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -154,6 +154,10 @@ extern int ble_get_npl_element_info(esp_bt_controller_config_t *cfg, ble_npl_cou
 extern void bt_track_pll_cap(void);
 extern char *ble_controller_get_compile_version(void);
 extern const char *r_ble_controller_get_rom_compile_version(void);
+#if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+extern void ble_ll_supported_features_init(void);
+#endif //CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+
 #if CONFIG_BT_RELEASE_IRAM
 extern uint32_t _iram_bt_text_start;
 extern uint32_t _bss_bt_end;
@@ -193,6 +197,9 @@ static void esp_bt_ctrl_log_partition_get_and_erase_first_block(void);
 /* Local variable definition
  ***************************************************************************
  */
+#if (CONFIG_ESP32C2_REV_MIN_FULL < 200) && (!CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY)
+void *g_ble_lll_rfmgmt_env_p;
+#endif
 /* Static variable declare */
 static DRAM_ATTR esp_bt_controller_status_t ble_controller_status = ESP_BT_CONTROLLER_STATUS_IDLE;
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
@@ -440,6 +447,17 @@ static DRAM_ATTR modem_clock_lpclk_src_t s_bt_lpclk_src = MODEM_CLOCK_LPCLK_SRC_
 
 #define BLE_RTC_DELAY_US                    (1800)
 
+#define BLE_CONTROLLER_MALLOC_CAPS          (MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT|MALLOC_CAP_DMA)
+void *malloc_ble_controller_mem(size_t size)
+{
+    return heap_caps_malloc(size, BLE_CONTROLLER_MALLOC_CAPS);
+}
+
+uint32_t get_ble_controller_free_heap_size(void)
+{
+    return heap_caps_get_free_size(BLE_CONTROLLER_MALLOC_CAPS);
+}
+
 static const struct osi_coex_funcs_t s_osi_coex_funcs_ro = {
     ._magic = OSI_COEX_MAGIC_VALUE,
     ._version = OSI_COEX_VERSION,
@@ -532,7 +550,12 @@ static int esp_ecc_gen_dh_key(const uint8_t *peer_pub_key_x, const uint8_t *peer
 
 static int esp_intr_alloc_wrapper(int source, int flags, intr_handler_t handler, void *arg, void **ret_handle_in)
 {
+#if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+    int rc = esp_intr_alloc(source, flags, handler, arg, (intr_handle_t *)ret_handle_in);
+#else
     int rc = esp_intr_alloc(source, flags | ESP_INTR_FLAG_IRAM, handler, arg, (intr_handle_t *)ret_handle_in);
+#endif
+
     return rc;
 }
 
@@ -741,6 +764,8 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
         return ret;
     }
 
+    /* If we place the ble code into flash, don't need to initialize ROM. */
+#if !CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
 #if DEFAULT_BT_LE_50_FEATURE_SUPPORT || DEFAULT_BT_LE_ROLE_CENTROL || DEFAULT_BT_LE_ROLE_OBSERVER
     extern int esp_ble_rom_func_ptr_init_all(void);
     esp_ble_rom_func_ptr_init_all();
@@ -749,6 +774,7 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
     extern int esp_ble_rom_func_ptr_init_legacy_adv_and_slave(void);
     esp_ble_rom_func_ptr_init_legacy_adv_and_slave();
 #endif
+#endif //!CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
 
     /* Initialize the function pointers for OS porting */
     npl_freertos_funcs_init();
@@ -798,6 +824,11 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
 #if CONFIG_SW_COEXIST_ENABLE
     coex_init();
 #endif
+
+#if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+    ble_ll_supported_features_init();
+#endif //CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+
     ret = ble_controller_init(cfg);
     if (ret != ESP_OK) {
         ESP_LOGW(NIMBLE_PORT_LOG_TAG, "ble_controller_init failed %d", ret);
@@ -1114,12 +1145,20 @@ esp_err_t esp_ble_tx_power_set(esp_ble_power_type_t power_type, esp_power_level_
 
     switch (power_type) {
     case ESP_BLE_PWR_TYPE_DEFAULT:
-    case ESP_BLE_PWR_TYPE_ADV:
-    case ESP_BLE_PWR_TYPE_SCAN:
         if (ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
             stat = ESP_OK;
         }
         break;
+    case ESP_BLE_PWR_TYPE_ADV:
+        if (ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_ADV, 0xFF, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
+    case ESP_BLE_PWR_TYPE_SCAN:
+        if (ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
     case ESP_BLE_PWR_TYPE_CONN_HDL0:
     case ESP_BLE_PWR_TYPE_CONN_HDL1:
     case ESP_BLE_PWR_TYPE_CONN_HDL2:
@@ -1146,9 +1185,13 @@ esp_err_t esp_ble_tx_power_set_enhanced(esp_ble_enhanced_power_type_t power_type
     esp_err_t stat = ESP_FAIL;
     switch (power_type) {
     case ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT:
+        if (ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
     case ESP_BLE_ENHANCED_PWR_TYPE_SCAN:
     case ESP_BLE_ENHANCED_PWR_TYPE_INIT:
-        if (ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
+        if (ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0, power_level) == 0) {
             stat = ESP_OK;
         }
         break;
@@ -1171,11 +1214,15 @@ esp_power_level_t esp_ble_tx_power_get(esp_ble_power_type_t power_type)
     int tx_level = 0;
 
     switch (power_type) {
-    case ESP_BLE_PWR_TYPE_ADV:
-    case ESP_BLE_PWR_TYPE_SCAN:
     case ESP_BLE_PWR_TYPE_DEFAULT:
         tx_level = ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
         break;
+    case ESP_BLE_PWR_TYPE_ADV:
+        tx_level = ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_ADV, 0);
+        break;
+    case ESP_BLE_PWR_TYPE_SCAN:
+        tx_level = ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0);
+        break;
     case ESP_BLE_PWR_TYPE_CONN_HDL0:
     case ESP_BLE_PWR_TYPE_CONN_HDL1:
     case ESP_BLE_PWR_TYPE_CONN_HDL2:
@@ -1204,9 +1251,11 @@ esp_power_level_t esp_ble_tx_power_get_enhanced(esp_ble_enhanced_power_type_t po
 
     switch (power_type) {
     case ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT:
+        tx_level = ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
+        break;
     case ESP_BLE_ENHANCED_PWR_TYPE_SCAN:
     case ESP_BLE_ENHANCED_PWR_TYPE_INIT:
-        tx_level = ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
+        tx_level = ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0);
         break;
     case ESP_BLE_ENHANCED_PWR_TYPE_ADV:
     case ESP_BLE_ENHANCED_PWR_TYPE_CONN:

components/bt/controller/esp32c2/dummy.c

@@ -0,0 +1,320 @@
+/*
+ * SPDX-FileCopyrightText: 2024 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#include "esp_bt_cfg.h"
+
+#define BLE_ERR_UNKNOWN_HCI_CMD         (0x01)
+/* LL Features */
+#define BLE_LL_FEAT_LE_ENCRYPTION       (0x0000000001)
+#define BLE_LL_FEAT_CONN_PARM_REQ       (0x0000000002)
+#define BLE_LL_FEAT_EXTENDED_REJ        (0x0000000004)
+#define BLE_LL_FEAT_PERIPH_INIT         (0x0000000008)
+#define BLE_LL_FEAT_LE_PING             (0x0000000010)
+#define BLE_LL_FEAT_DATA_LEN_EXT        (0x0000000020)
+#define BLE_LL_FEAT_LL_PRIVACY          (0x0000000040)
+#define BLE_LL_FEAT_EXT_SCAN_FILT       (0x0000000080)
+#define BLE_LL_FEAT_LE_2M_PHY           (0x0000000100)
+#define BLE_LL_FEAT_STABLE_MOD_ID_TX    (0x0000000200)
+#define BLE_LL_FEAT_STABLE_MOD_ID_RX    (0x0000000400)
+#define BLE_LL_FEAT_LE_CODED_PHY        (0x0000000800)
+#define BLE_LL_FEAT_EXT_ADV             (0x0000001000)
+#define BLE_LL_FEAT_PERIODIC_ADV        (0x0000002000)
+#define BLE_LL_FEAT_CSA2                (0x0000004000)
+#define BLE_LL_FEAT_LE_POWER_CLASS_1    (0x0000008000)
+#define BLE_LL_FEAT_MIN_USED_CHAN       (0x0000010000)
+#define BLE_LL_FEAT_CTE_REQ             (0x0000020000)
+#define BLE_LL_FEAT_CTE_RSP             (0x0000040000)
+#define BLE_LL_FEAT_CTE_TX              (0x0000080000)
+#define BLE_LL_FEAT_CTE_RX              (0x0000100000)
+#define BLE_LL_FEAT_CTE_AOD             (0x0000200000)
+#define BLE_LL_FEAT_CTE_AOA             (0x0000400000)
+#define BLE_LL_FEAT_CTE_RECV            (0x0000800000)
+#define BLE_LL_FEAT_SYNC_TRANS_SEND     (0x0001000000)
+#define BLE_LL_FEAT_SYNC_TRANS_RECV     (0x0002000000)
+#define BLE_LL_FEAT_SCA_UPDATE          (0x0004000000)
+#define BLE_LL_FEAT_REM_PKEY            (0x0008000000)
+#define BLE_LL_FEAT_CIS_CENTRAL         (0x0010000000)
+#define BLE_LL_FEAT_CIS_PERIPH          (0x0020000000)
+#define BLE_LL_FEAT_ISO_BROADCASTER     (0x0040000000)
+#define BLE_LL_FEAT_SYNC_RECV           (0x0080000000)
+#define BLE_LL_FEAT_CIS_HOST            (0x0100000000)
+#define BLE_LL_FEAT_POWER_CTRL_REQ      (0x0200000000)
+#define BLE_LL_FEAT_POWER_CHANGE_IND    (0x0400000000)
+#define BLE_LL_FEAT_PATH_LOSS_MON       (0x0800000000)
+#define BLE_LL_FEAT_PERIODIC_ADV_ADI    (0x1000000000)
+#define BLE_LL_FEAT_CONN_SUBRATING      (0x2000000000)
+#define BLE_LL_FEAT_CONN_SUBRATING_HOST (0x4000000000)
+#define BLE_LL_FEAT_CHANNEL_CLASS       (0x8000000000)
+
+uint64_t ble_ll_supported_features;
+
+void
+ble_ll_supported_features_init(void)
+{
+    ble_ll_supported_features = BLE_LL_FEAT_EXTENDED_REJ;
+    ble_ll_supported_features |= BLE_LL_FEAT_DATA_LEN_EXT;
+
+#if DEFAULT_BT_LE_ROLE_CENTROL || DEFAULT_BT_LE_ROLE_PERIPHERAL
+    ble_ll_supported_features |= BLE_LL_FEAT_PERIPH_INIT;
+    ble_ll_supported_features |= BLE_LL_FEAT_CONN_PARM_REQ;
+#endif
+
+#if CONFIG_BT_LE_FEAT_LL_ENCRYPTION
+    ble_ll_supported_features |= BLE_LL_FEAT_LE_ENCRYPTION;
+#endif
+
+    ble_ll_supported_features |= (BLE_LL_FEAT_LL_PRIVACY | BLE_LL_FEAT_EXT_SCAN_FILT);
+    ble_ll_supported_features |= BLE_LL_FEAT_LE_PING;
+
+#if DEFAULT_BT_LE_EXT_ADV
+    ble_ll_supported_features |= BLE_LL_FEAT_EXT_ADV;
+#endif
+
+#if DEFAULT_BT_LE_PERIODIC_ADV
+    ble_ll_supported_features |= BLE_LL_FEAT_PERIODIC_ADV;
+    ble_ll_supported_features |= BLE_LL_FEAT_PERIODIC_ADV_ADI;
+#endif
+
+#if DEFAULT_BT_LE_PAST
+    ble_ll_supported_features |= BLE_LL_FEAT_SYNC_TRANS_RECV;
+    ble_ll_supported_features |= BLE_LL_FEAT_SYNC_TRANS_SEND;
+#endif
+
+#if DEGAULT_BT_LE_2M_PHY
+    ble_ll_supported_features |= BLE_LL_FEAT_LE_2M_PHY;
+#endif
+
+#if DEGAULT_BT_LE_CODED_PHY
+    ble_ll_supported_features |= BLE_LL_FEAT_LE_CODED_PHY;
+#endif
+
+#if DEFAULT_BT_LE_50_FEATURE_SUPPORT
+    ble_ll_supported_features |= BLE_LL_FEAT_CSA2;
+    ble_ll_supported_features |= BLE_LL_FEAT_SCA_UPDATE;
+    ble_ll_supported_features |= BLE_LL_FEAT_REM_PKEY;
+    ble_ll_supported_features |= BLE_LL_FEAT_CHANNEL_CLASS;
+#endif
+}
+
+#if !DEFAULT_BT_LE_ROLE_BROADCASTER
+void r_ble_ll_adv_rpa_timeout(void) { }
+void r_ble_lll_adv_halt(void) { }
+void r_ble_lll_adv_event_rmvd_from_sched(void) { }
+void r_ble_lll_adv_ext_event_rmvd_from_sched(void) { }
+int  r_ble_ll_adv_enabled(void) { return 0; }
+int  r_ble_ll_adv_can_chg_whitelist(void) { return 1; }
+int  r_ble_ll_adv_set_random_addr(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+void r_ble_ll_adv_reset(void) { }
+void r_ble_ll_adv_init(void) { }
+void r_ble_ll_adv_deinit(void) { }
+int  r_ble_ll_adv_env_init(void) { return 0; }
+void r_ble_ll_adv_env_deinit(void) { }
+int  r_ble_lll_adv_rx_pkt_isr(void) { return -1; }
+void r_ble_ll_adv_rx_pkt_in(void) { }
+int  r_ble_ll_adv_set_adv_params(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_read_txpwr(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_hci_set_adv_data(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_hci_set_scan_rsp_data(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_hci_adv_set_enable(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_vendor_hci_legacy_adv_clear(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_set_data_related_addr_change(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif // !DEFAULT_BT_LE_ROLE_BROADCASTER
+
+#if !DEFAULT_BT_LE_EXT_ADV
+bool r_ble_ll_adv_ext_check_data_itvl(void) { return true; }
+void r_ble_lll_adv_coex_dpc_update_on_aux_scheduled(void) { }
+void r_ble_lll_adv_coex_dpc_calc_pti_update_itvl(void) { }
+void r_ble_lll_adv_sec_done(void) { }
+int r_ble_lll_adv_sec_schedule_next_aux(void) { return 0; }
+void r_ble_lll_adv_sec_event_done(void) { }
+int  r_ble_lll_adv_secondary_tx_start_cb(void) { return 0; }
+void r_ble_lll_adv_aux_schedule(void) { }
+void r_ble_lll_adv_update_rsp_offset(void) { }
+int  r_ble_ll_adv_hci_set_random_addr(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_ext_set_param(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_ext_set_adv_data(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_ext_set_scan_rsp(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_ext_set_enable(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_rd_max_adv_data_len(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_rd_sup_adv_sets(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_remove(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_clear_all(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_EXT_ADV
+
+#if !DEFAULT_BT_LE_PERIODIC_ADV
+void r_ble_ll_adv_sm_stop_periodic(void) { }
+void r_ble_lll_adv_periodic_event_done(void) { }
+int  r_ble_lll_adv_sync_tx_start_cb(void) { return 0; }
+void r_ble_lll_adv_sync_tx_end(void) { }
+int  r_ble_lll_adv_periodic_start(void) { return 0; }
+void r_ble_lll_adv_periodic_rmvd_from_sched(void) { }
+int  r_ble_ll_adv_periodic_set_param(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_periodic_set_data(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_periodic_enable(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_PERIODIC_ADV
+
+#if !DEFAULT_BT_LE_ROLE_OBSERVER
+void r_ble_lll_scan_halt(void) { }
+void r_ble_ll_scan_end_adv_evt(void) { }
+void r_ble_ll_scan_rx_pkt_in(void) { }
+int  r_ble_lll_scan_rx_pkt_isr(void) { return -1; }
+int  r_ble_ll_scan_env_init(void) { return 0; }
+void r_ble_ll_scan_env_deinit(void) {  }
+void r_ble_ll_scan_init(void) { }
+void r_ble_ll_scan_deinit(void) { }
+void r_ble_ll_scan_reset(void) { }
+int  r_ble_ll_scan_can_chg_whitelist(void) { return 1; }
+int  r_ble_ll_scan_enabled(void) { return false; }
+int  r_ble_lll_scan_chk_resume(void) { return -1; }
+int  r_ble_ll_scan_set_scan_params(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_hci_scan_set_enable(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_scan_hci_update_adv_report_flow_ctrl(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_scan_hci_set_adv_report_flow_ctrl(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_ROLE_OBSERVER
+
+#if !DEFAULT_BT_LE_EXT_SCAN
+void r_ble_lll_scan_duration_period_timers_restart(void) { }
+void r_ble_lll_scan_duration_period_timers_stop(void) { }
+int r_ble_ll_hci_send_legacy_ext_adv_report(void) { return -1; }
+void r_ble_lll_sched_rmv_elem_type(void) { }
+void r_ble_ll_scan_send_truncated(void) { }
+void r_ble_ll_scan_aux_data_unref(void) { }
+void r_ble_lll_scan_sched_remove(void) { }
+void r_ble_lll_scan_aux_data_free(void) { }
+void r_ble_lll_aux_scan_drop(void) { }
+int r_ble_lll_sched_aux_scan(void) { return -1; }
+int r_ble_lll_scan_rx_isr_on_aux(void) { return -1; }
+void r_ble_lll_scan_period_timer_cb(void) { }
+void r_ble_lll_scan_duration_timer_cb(void) { }
+void r_ble_ll_scan_rx_pkt_in_on_aux(void) { }
+int  r_ble_ll_set_ext_scan_params(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_hci_ext_scan_set_enable(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_EXT_SCAN
+
+#if !DEFAULT_BT_LE_ROLE_CENTROL
+void r_ble_ll_init_rx_pkt_in(void) { }
+int  r_ble_lll_init_rx_pkt_isr(void) { return -1; }
+int  r_ble_ll_conn_create(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_conn_create_cancel(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_ROLE_CENTROL
+
+#if !DEFAULT_BT_LE_ROLE_CENTROL || !DEFAULT_BT_LE_EXT_SCAN
+int  r_ble_ll_ext_conn_create(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_ROLE_CENTROL || !DEFAULT_BT_LE_EXT_SCAN
+
+#if !DEFAULT_BT_LE_ROLE_PERIPHERAL
+int r_ble_ll_conn_slave_start(void) { return 0; }
+#endif //!DEFAULT_BT_LE_ROLE_PERIPHERAL
+
+#if !DEFAULT_BT_LE_ROLE_CENTROL && !DEFAULT_BT_LE_ROLE_PERIPHERAL
+void r_ble_ll_conn_rx_data_pdu(void) { }
+int  r_ble_lll_conn_rx_pkt_isr(void) { return -1; }
+int  r_ble_ll_hci_disconnect(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_conn_hci_rd_rem_ver_cmd(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_conn_hci_update(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_conn_hci_rd_chan_map(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_conn_hci_read_rem_features(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_conn_hci_param_rr(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_conn_hci_param_nrr(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_ROLE_CENTROL && !DEFAULT_BT_LE_ROLE_PERIPHERAL
+
+#if !CONFIG_BT_LE_FEAT_LL_ENCRYPTION
+int r_ble_ll_conn_chk_phy_upd_start(void) { return -1; }
+void r_ble_ll_hci_ev_encrypt_chg(void) { }
+int r_ble_ll_ctrl_enc_allowed_pdu_rx(void) { return 1; }
+int r_ble_ll_ctrl_enc_allowed_pdu_tx(void) { return 1; }
+uint8_t r_ble_ll_ctrl_rx_start_enc_rsp(void) { return 0x07; }
+uint8_t r_ble_ll_ctrl_rx_pause_enc_rsp(void) { return 0x07; }
+int  r_ble_ll_hci_le_encrypt(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!CONFIG_BT_LE_FEAT_LL_ENCRYPTION
+
+#if !DEFAULT_BT_LE_ROLE_PERIPHERAL || !CONFIG_BT_LE_FEAT_LL_ENCRYPTION
+uint8_t r_ble_ll_ctrl_rx_pause_enc_req(void) { return 0x07; }
+uint8_t r_ble_ll_ctrl_rx_enc_req(void) { return 0x07; }
+int r_ble_ll_conn_hci_le_ltk_reply(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int r_ble_ll_conn_hci_le_ltk_neg_reply(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_ROLE_PERIPHERAL || !CONFIG_BT_LE_FEAT_LL_ENCRYPTION
+
+#if !DEFAULT_BT_LE_ROLE_CENTROL || !CONFIG_BT_LE_FEAT_LL_ENCRYPTION
+uint8_t r_ble_ll_ctrl_rx_start_enc_req(void) { return 0x07; }
+void r_ble_ll_ctrl_rx_enc_rsp(void) { }
+void r_ble_ll_ctrl_enc_req_make(void) { }
+int r_ble_ll_conn_hci_le_start_encrypt(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_ROLE_CENTROL || !CONFIG_BT_LE_FEAT_LL_ENCRYPTION
+
+#if !DEGAULT_BT_LE_2M_PHY && !DEGAULT_BT_LE_CODED_PHY
+void r_ble_ll_ctrl_phy_update_proc_complete(void) { }
+void r_ble_ll_ctrl_phy_update_cancel(void) { }
+uint8_t r_ble_ll_ctrl_rx_phy_update_ind(void) { return 0x07; }
+uint8_t r_ble_ll_ctrl_rx_phy_rsp(void) { return 0x07; }
+uint8_t r_ble_ll_ctrl_rx_phy_req(void) { return 0x07; }
+void r_ble_ll_ctrl_phy_req_rsp_make(void) { }
+#endif //DEGAULT_BT_LE_2M_PHY && DEGAULT_BT_LE_CODED_PHY
+
+#if !DEFAULT_BT_LE_PERIODIC_SYNC
+void r_ble_lll_sync_halt(void) { }
+void r_ble_lll_sync_rmvd_from_sched(void) { }
+int  r_ble_ll_sync_list_search(void) { return -1; }
+uint8_t r_ble_ll_ctrl_rx_periodic_sync_ind(void) { return 0x07; }
+void r_ble_ll_sync_rx_pkt_in(void) {  }
+int  r_ble_lll_sync_rx_pkt_isr(void) { return -1; }
+int  r_ble_ll_sync_env_init(void) { return 0; }
+void r_ble_ll_sync_env_deinit(void) {  }
+void r_ble_ll_sync_init(void) {  }
+void r_ble_ll_sync_deinit(void) {  }
+void r_ble_ll_sync_reset(void) {  }
+bool r_ble_ll_sync_enabled(void) { return false; }
+int  r_ble_ll_sync_create(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_sync_cancel(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_sync_terminate(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_sync_list_add(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_sync_list_remove(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_sync_list_clear(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_sync_list_size(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_sync_receive_enable(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_PERIODIC_SYNC
+
+#if !DEFAULT_BT_LE_PAST || !DEFAULT_BT_LE_PERIODIC_ADV
+int  r_ble_ll_adv_periodic_set_info_transfer(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_PAST || !DEFAULT_BT_LE_PERIODIC_ADV
+
+#if !DEFAULT_BT_LE_PAST || !DEFAULT_BT_LE_PERIODIC_SYNC
+int  r_ble_ll_sync_transfer(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_set_sync_transfer_params(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_set_default_sync_transfer_params(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_PAST || !DEFAULT_BT_LE_PERIODIC_SYNC
+
+#if !DEFAULT_BT_LE_50_FEATURE_SUPPORT
+uint8_t r_ble_ll_ctrl_rx_channel_reporting_ind(void) { return 0x07; }
+uint8_t r_ble_ll_ctrl_rx_channel_status_ind(void) { return 0x07; }
+uint8_t r_ble_ll_ctrl_rx_sca_req(void) { return 0x07; }
+uint8_t r_ble_ll_ctrl_rx_sca_rsp(void) { return 0x07; }
+void r_ble_ll_ctrl_channel_class_reporting_make(void) { }
+void r_ble_ll_ctrl_channel_class_enable_make(void) { }
+void r_ble_ll_ctrl_sca_req_rsp_make(void) { }
+int  r_ble_ll_modify_sca(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_conn_req_peer_sca(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_50_FEATURE_SUPPORT
+
+#if !DEFAULT_BT_LE_50_FEATURE_SUPPORT
+int  r_ble_ll_conn_hci_le_rd_phy(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_hci_le_set_def_phy(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_conn_hci_le_set_phy(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_50_FEATURE_SUPPORT
+
+#if !CONFIG_BT_LE_DTM_ENABLED
+void r_ble_lll_dtm_rx_pkt_in(void) {  }
+int  r_ble_lll_dtm_rx_isr_end(void) { return -1; }
+void r_ble_lll_dtm_reset(void) { }
+void r_ble_lll_dtm_init(void) { }
+void r_ble_lll_dtm_deinit(void) { }
+int  r_ble_lll_dtm_env_init(void) { return 0; }
+void r_ble_lll_dtm_env_deinit(void) { }
+int  r_ble_lll_hci_dtm_tx_test(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_lll_hci_dtm_rx_test(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_lll_dtm_end_test(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_lll_hci_dtm_rx_test_v2(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_lll_hci_dtm_tx_test_v2(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!CONFIG_BT_LE_DTM_ENABLED

components/bt/controller/esp32c2/esp_bt_cfg.h

@@ -45,6 +45,14 @@ extern "C" {
     #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (0)
     #endif
 
+    #define DEGAULT_BT_LE_2M_PHY                         (CONFIG_BT_NIMBLE_LL_CFG_FEAT_LE_2M_PHY)
+    #define DEGAULT_BT_LE_CODED_PHY                      (CONFIG_BT_NIMBLE_LL_CFG_FEAT_LE_CODED_PHY)
+    #define DEFAULT_BT_LE_EXT_ADV                        (CONFIG_BT_NIMBLE_EXT_ADV)
+    #define DEFAULT_BT_LE_PERIODIC_ADV                   (CONFIG_BT_NIMBLE_ENABLE_PERIODIC_ADV)
+    #define DEFAULT_BT_LE_EXT_SCAN                       (CONFIG_BT_NIMBLE_EXT_SCAN)
+    #define DEFAULT_BT_LE_PERIODIC_SYNC                  (CONFIG_BT_NIMBLE_ENABLE_PERIODIC_SYNC)
+    #define DEFAULT_BT_LE_PAST                           (CONFIG_BT_NIMBLE_PERIODIC_ADV_SYNC_TRANSFER)
+
     #define DEFAULT_BT_LE_ROLE_OBSERVER                  MYNEWT_VAL(BLE_ROLE_OBSERVER)
     #define DEFAULT_BT_LE_ROLE_CENTROL                   MYNEWT_VAL(BLE_ROLE_CENTRAL)
     #define DEFAULT_BT_LE_ROLE_PERIPHERAL                MYNEWT_VAL(BLE_ROLE_PERIPHERAL)
@@ -122,12 +130,55 @@ extern "C" {
     #else
         #define DEFAULT_BT_LE_HCI_EVT_LO_BUF_COUNT (8)
     #endif
+
     #if defined(CONFIG_BT_LE_50_FEATURE_SUPPORT)
         #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (1)
     #else
         #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (0)
     #endif
 
+    #if defined(CONFIG_BT_LE_LL_CFG_FEAT_LE_2M_PHY)
+        #define DEGAULT_BT_LE_2M_PHY (CONFIG_BT_LE_LL_CFG_FEAT_LE_2M_PHY)
+    #else
+        #define DEGAULT_BT_LE_2M_PHY (0)
+    #endif
+
+    #if defined(CONFIG_BT_LE_LL_CFG_FEAT_LE_CODED_PHY)
+        #define DEGAULT_BT_LE_CODED_PHY (CONFIG_BT_LE_LL_CFG_FEAT_LE_CODED_PHY)
+    #else
+        #define DEGAULT_BT_LE_CODED_PHY (0)
+    #endif
+
+    #if defined(CONFIG_BT_LE_EXT_ADV)
+        #define DEFAULT_BT_LE_EXT_ADV       (CONFIG_BT_LE_EXT_ADV)
+    #else
+        #define DEFAULT_BT_LE_EXT_ADV       (0)
+    #endif
+
+    #if defined(CONFIG_BT_LE_ENABLE_PERIODIC_ADV)
+        #define DEFAULT_BT_LE_PERIODIC_ADV  (CONFIG_BT_LE_ENABLE_PERIODIC_ADV)
+    #else
+        #define DEFAULT_BT_LE_PERIODIC_ADV  (0)
+    #endif
+
+    #if defined(CONFIG_BT_LE_EXT_SCAN)
+        #define DEFAULT_BT_LE_EXT_SCAN      (CONFIG_BT_LE_EXT_SCAN)
+    #else
+        #define DEFAULT_BT_LE_EXT_SCAN      (0)
+    #endif
+
+    #if defined(CONFIG_BT_LE_ENABLE_PERIODIC_SYNC)
+        #define DEFAULT_BT_LE_PERIODIC_SYNC  (CONFIG_BT_LE_ENABLE_PERIODIC_SYNC)
+    #else
+        #define DEFAULT_BT_LE_PERIODIC_SYNC  (0)
+    #endif
+
+    #if defined(BT_LE_PERIODIC_ADV_SYNC_TRANSFER)
+        #define DEFAULT_BT_LE_PAST          (BT_LE_PERIODIC_ADV_SYNC_TRANSFER)
+    #else
+        #define DEFAULT_BT_LE_PAST          (0)
+    #endif
+
     #if defined(CONFIG_BT_LE_ROLE_CENTROL_ENABLE)
         #define DEFAULT_BT_LE_ROLE_CENTROL (1)
     #else
@@ -169,6 +220,12 @@ extern "C" {
 
 #define DEFAULT_BT_LE_COEX_PHY_CODED_TX_RX_TLIM_EFF CONFIG_BT_LE_COEX_PHY_CODED_TX_RX_TLIM_EFF
 
+#ifdef CONFIG_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
+#define DEFAULT_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS  (CONFIG_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS)
+#else
+#define DEFAULT_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS  (0)
+#endif
+
 #ifdef CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #define HCI_UART_EN CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #else

components/bt/controller/esp32c3/Kconfig.in

@@ -200,8 +200,8 @@ choice BT_CTRL_DFT_TX_POWER_LEVEL
         bool "+15dBm"
     config BT_CTRL_DFT_TX_POWER_LEVEL_P18
         bool "+18dBm"
-    config BT_CTRL_DFT_TX_POWER_LEVEL_P21
-        bool "+21dBm"
+    config BT_CTRL_DFT_TX_POWER_LEVEL_P20
+        bool "+20dBm"
 endchoice
 
 config BT_CTRL_DFT_TX_POWER_LEVEL_EFF
@@ -221,11 +221,12 @@ config BT_CTRL_DFT_TX_POWER_LEVEL_EFF
     default 12 if BT_CTRL_DFT_TX_POWER_LEVEL_P12
     default 13 if BT_CTRL_DFT_TX_POWER_LEVEL_P15
     default 14 if BT_CTRL_DFT_TX_POWER_LEVEL_P18
-    default 15 if BT_CTRL_DFT_TX_POWER_LEVEL_P21
+    default 15 if BT_CTRL_DFT_TX_POWER_LEVEL_P20
     default 0
 
 config BT_CTRL_BLE_ADV_REPORT_FLOW_CTRL_SUPP
     bool "BLE adv report flow control supported"
+    depends on (!BT_CTRL_RUN_IN_FLASH_ONLY) || (BT_CTRL_RUN_IN_FLASH_ONLY && BT_CTRL_BLE_SCAN)
     default y
     help
         The function is mainly used to enable flow control for advertising reports. When it is enabled,
@@ -402,10 +403,10 @@ menu "MODEM SLEEP Options"
                 bluetooth can work under light sleep enabled. Main crystal has a relatively better performance
                 than other bluetooth low power clock sources.
         config BT_CTRL_LPCLK_SEL_EXT_32K_XTAL
-            bool "External 32kHz crystal"
-            depends on RTC_CLK_SRC_EXT_CRYS
+            bool "External 32kHz crystal/oscillator"
+            depends on RTC_CLK_SRC_EXT_CRYS || RTC_CLK_SRC_EXT_OSC
             help
-                External 32kHz crystal has a nominal frequency of 32.768kHz and provides good frequency
+                External 32kHz crystal/oscillator has a nominal frequency of 32.768kHz and provides good frequency
                 stability. If used as Bluetooth low power clock, External 32kHz can support Bluetooth
                 modem sleep to be used with both DFS and light sleep.
 
@@ -489,3 +490,63 @@ config BT_CTRL_LE_PING_EN
     help
         If this option is disabled, The Controller will not start the LE authenticated payload timer.
         This option is used for some compatibility problems related to LE ping procedure.
+
+menu "BLE disconnect when instant passed"
+    config BT_CTRL_BLE_LLCP_CONN_UPDATE
+        bool "BLE ACL connection update procedure"
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when instant passed during connection update procedure.
+
+    config BT_CTRL_BLE_LLCP_CHAN_MAP_UPDATE
+        bool "BLE ACL channel map update procedure"
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when instant passed in channel map update procedure.
+
+    config BT_CTRL_BLE_LLCP_PHY_UPDATE
+        bool "BLE ACL PHY update procedure"
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when instant passed in PHY update procedure.
+endmenu
+config BT_CTRL_RUN_IN_FLASH_ONLY
+    bool "Put all BLE Controller code in flash"
+    default n
+    help
+        If this option is enabled, all code for the Bluetooth controller will be moved from ROM and IRAM
+        to flash, saving over 20K bytes of memory. However, it will require more flash resources and the
+        performance of Bluetooth will decrease If this option is enabled, Bluetooth may not work properly
+        during erasing flash. It is recommended to turn on the auto suspend function of flash. After auto
+        suspend is turned on, Bluetooth interrupts can be executed normally during erasing flash, with less
+        impact on Bluetooth performance.
+
+config BT_CTRL_DTM_ENABLE
+    depends on BT_CTRL_RUN_IN_FLASH_ONLY
+    bool "Enable direct test mode feature"
+    default n
+
+config BT_CTRL_BLE_MASTER
+    depends on BT_CTRL_RUN_IN_FLASH_ONLY
+    bool "Enable BLE master role feature"
+    default y
+
+config BT_CTRL_BLE_TEST
+    depends on BT_CTRL_RUN_IN_FLASH_ONLY
+    bool "Enable BLE QA test feature"
+    default n
+
+config BT_CTRL_BLE_SCAN
+    depends on BT_CTRL_RUN_IN_FLASH_ONLY
+    bool "Enable BLE scan feature"
+    default y
+config BT_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
+    bool "Enable enhanced Access Address check in CONNECT_IND"
+    default n
+    help
+        Enabling this option will add stricter verification of the Access Address in the CONNECT_IND PDU.
+        This improves security by ensuring that only connection requests with valid Access Addresses are accepted.
+        If disabled, only basic checks are applied, improving compatibility.

components/bt/controller/esp32c3/bt.c

@@ -256,7 +256,6 @@ extern int API_vhci_host_register_callback(const vhci_host_callback_t *callback)
 extern int ble_txpwr_set(int power_type, uint16_t handle, int power_level);
 extern int ble_txpwr_get(int power_type, uint16_t handle);
 
-extern uint16_t l2c_ble_link_get_tx_buf_num(void);
 extern void coex_pti_v2(void);
 
 extern bool btdm_deep_sleep_mem_init(void);
@@ -272,6 +271,7 @@ extern void ets_backup_dma_copy(uint32_t reg, uint32_t mem_addr, uint32_t num, b
 #endif
 
 extern void btdm_cca_feature_enable(void);
+extern void btdm_aa_check_enhance_enable(void);
 
 extern uint32_t _bt_bss_start;
 extern uint32_t _bt_bss_end;
@@ -495,7 +495,11 @@ static int interrupt_alloc_wrapper(int cpu_id, int source, intr_handler_t handle
 {
     btdm_isr_alloc_t p;
     p.source = source;
+#if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+    p.flags = ESP_INTR_FLAG_LEVEL3;
+#else
     p.flags = ESP_INTR_FLAG_LEVEL3 | ESP_INTR_FLAG_IRAM;
+#endif
     p.fn = handler;
     p.arg = arg;
     p.handle = (intr_handle_t *)ret_handle;
@@ -777,7 +781,8 @@ static void btdm_sleep_enter_phase1_wrapper(uint32_t lpcycles)
     // allow a maximum time uncertainty to be about 488ppm(1/2048) at least as clock drift
     // and set the timer in advance
     uint32_t uncertainty = (us_to_sleep >> 11);
-#if CONFIG_FREERTOS_USE_TICKLESS_IDLE
+#if CONFIG_BT_CTRL_MAIN_XTAL_PU_DURING_LIGHT_SLEEP
+    // recalculate clock drift when Bluetooth using main XTAL during light sleep
     if (rtc_clk_slow_src_get() == SOC_RTC_SLOW_CLK_SRC_RC_SLOW) {
         uncertainty = us_to_sleep * BTDM_RTC_SLOW_CLK_RC_DRIFT_PERCENT / 100;
     }
@@ -956,6 +961,9 @@ static void btdm_funcs_table_ready_wrapper(void)
 #if BT_BLE_CCA_MODE == 2
     btdm_cca_feature_enable();
 #endif
+#if BLE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS_ENABLED
+    btdm_aa_check_enhance_enable();
+#endif
 }
 
 bool bt_async_wakeup_request(void)
@@ -1421,6 +1429,10 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
 
     ESP_LOGI(BT_LOG_TAG, "BT controller compile version [%s]", btdm_controller_get_compile_version());
 
+#if (CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY)
+    ESP_LOGI(BT_LOG_TAG,"Put all controller code in flash");
+#endif
+
     if ((err = btdm_low_power_mode_init(cfg)) != ESP_OK) {
         ESP_LOGE(BT_LOG_TAG, "Low power module initialization failed");
         goto error;
@@ -1433,7 +1445,10 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
     periph_module_enable(PERIPH_BT_MODULE);
     periph_module_reset(PERIPH_BT_MODULE);
 
-    if (btdm_controller_init(cfg) != 0) {
+    err = btdm_controller_init(cfg);
+
+    if (err != 0) {
+        ESP_LOGE(BT_LOG_TAG, "%s %d\n",__func__,err);
         err = ESP_ERR_NO_MEM;
         goto error;
     }
@@ -1749,7 +1764,7 @@ esp_power_level_t esp_ble_tx_power_get(esp_ble_power_type_t power_type)
         handle = power_type;
     }
 
-    lvl = (esp_power_level_t)ble_txpwr_get(power_type, handle);
+    lvl = (esp_power_level_t)ble_txpwr_get(enh_pwr_type, handle);
 
     return lvl;
 }
@@ -1861,11 +1876,6 @@ int IRAM_ATTR esp_bt_h4tl_eif_io_event_notify(int event)
     return btdm_hci_tl_io_event_post(event);
 }
 
-uint16_t esp_bt_get_tx_buf_num(void)
-{
-    return l2c_ble_link_get_tx_buf_num();
-}
-
 static void coex_wifi_sleep_set_hook(bool sleep)
 {
 

components/bt/controller/esp32c6/Kconfig.in

@@ -689,3 +689,19 @@ config BT_LE_DFT_TX_POWER_LEVEL_DBM_EFF
     default 18 if BT_LE_DFT_TX_POWER_LEVEL_P18
     default 20 if BT_LE_DFT_TX_POWER_LEVEL_P20
     default 0
+
+config BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
+    bool "Enable enhanced Access Address check in CONNECT_IND"
+    default n
+    help
+        Enabling this option will add stricter verification of the Access Address in the CONNECT_IND PDU.
+        This improves security by ensuring that only connection requests with valid Access Addresses are accepted.
+        If disabled, only basic checks are applied, improving compatibility.
+
+config BT_CTRL_RUN_IN_FLASH_ONLY
+    bool "Reduce BLE IRAM usage (READ DOCS FIRST) (EXPERIMENTAL)"
+    default n
+    help
+        Move most IRAM into flash. This will increase the usage of flash and reduce ble performance.
+        Because the code is moved to the flash, the execution speed of the code is reduced.
+        To have a small impact on performance, you need to enable flash suspend (SPI_FLASH_AUTO_SUSPEND).

components/bt/controller/esp32c6/bt.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -131,6 +131,10 @@ extern void r_ble_lll_rfmgmt_set_sleep_cb(void *s_cb, void *w_cb, void *s_arg,
 extern void r_ble_rtc_wake_up_state_clr(void);
 extern int os_msys_init(void);
 extern void os_msys_deinit(void);
+#if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+extern void r_ble_ll_scan_start_time_init_compensation(uint32_t init_compensation);
+extern void r_priv_sdk_config_insert_proc_time_set(uint16_t insert_proc_time);
+#endif // CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
 #if CONFIG_FREERTOS_USE_TICKLESS_IDLE
 extern sleep_retention_entries_config_t *r_esp_ble_mac_retention_link_get(uint8_t *size, uint8_t extra);
 extern void r_esp_ble_set_wakeup_overhead(uint32_t overhead);
@@ -389,13 +393,22 @@ void esp_bt_read_ctrl_log_from_flash(bool output)
 static bool s_ble_active = false;
 #ifdef CONFIG_PM_ENABLE
 static DRAM_ATTR esp_pm_lock_handle_t s_pm_lock = NULL;
-#define BTDM_MIN_TIMER_UNCERTAINTY_US      (200)
 #endif // CONFIG_PM_ENABLE
 static DRAM_ATTR modem_clock_lpclk_src_t s_bt_lpclk_src = MODEM_CLOCK_LPCLK_SRC_INVALID;
-
 #define BLE_RTC_DELAY_US_LIGHT_SLEEP        (2500)
 #define BLE_RTC_DELAY_US_MODEM_SLEEP        (500)
 
+#define BLE_CONTROLLER_MALLOC_CAPS          (MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT|MALLOC_CAP_DMA)
+void *malloc_ble_controller_mem(size_t size)
+{
+    return heap_caps_malloc(size, BLE_CONTROLLER_MALLOC_CAPS);
+}
+
+uint32_t get_ble_controller_free_heap_size(void)
+{
+    return heap_caps_get_free_size(BLE_CONTROLLER_MALLOC_CAPS);
+}
+
 static const struct osi_coex_funcs_t s_osi_coex_funcs_ro = {
     ._magic = OSI_COEX_MAGIC_VALUE,
     ._version = OSI_COEX_VERSION,
@@ -486,11 +499,13 @@ static int esp_ecc_gen_dh_key(const uint8_t *peer_pub_key_x, const uint8_t *peer
     return rc;
 }
 
-static int esp_intr_alloc_wrapper(int source, int flags, intr_handler_t handler,
-                                  void *arg, void **ret_handle_in)
+static int esp_intr_alloc_wrapper(int source, int flags, intr_handler_t handler, void *arg, void **ret_handle_in)
 {
-    int rc = esp_intr_alloc(source, flags | ESP_INTR_FLAG_IRAM, handler,
-                            arg, (intr_handle_t *)ret_handle_in);
+#if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+    int rc = esp_intr_alloc(source, flags, handler, arg, (intr_handle_t *)ret_handle_in);
+#else
+    int rc = esp_intr_alloc(source, flags | ESP_INTR_FLAG_IRAM, handler, arg, (intr_handle_t *)ret_handle_in);
+#endif
     return rc;
 }
 
@@ -613,7 +628,7 @@ static void sleep_modem_ble_mac_modem_state_deinit(void)
     }
 }
 
-void sleep_modem_light_sleep_overhead_set(uint32_t overhead)
+void IRAM_ATTR sleep_modem_light_sleep_overhead_set(uint32_t overhead)
 {
     r_esp_ble_set_wakeup_overhead(overhead);
 }
@@ -640,13 +655,16 @@ esp_err_t controller_sleep_init(void)
     if (rc != ESP_OK) {
         goto error;
     }
-#if CONFIG_FREERTOS_USE_TICKLESS_IDLE
-#if CONFIG_BT_LE_SLEEP_ENABLE && !CONFIG_MAC_BB_PD
+#endif // CONFIG_PM_ENABLE
+#if CONFIG_BT_LE_SLEEP_ENABLE && CONFIG_FREERTOS_USE_TICKLESS_IDLE
+#if SOC_PM_RETENTION_HAS_CLOCK_BUG && !CONFIG_MAC_BB_PD
 #error "CONFIG_MAC_BB_PD required for BLE light sleep to run properly"
-#endif // CONFIG_BT_LE_SLEEP_ENABLE && !CONFIG_MAC_BB_PD
+#endif // SOC_PM_RETENTION_HAS_CLOCK_BUG && !CONFIG_MAC_BB_PD
     /* Create a new regdma link for BLE related register restoration */
     rc = sleep_modem_ble_mac_modem_state_init(1);
-    assert(rc == 0);
+    if (rc != ESP_OK) {
+        goto error;
+    }
     esp_sleep_enable_bt_wakeup();
     ESP_LOGW(NIMBLE_PORT_LOG_TAG, "Enable light sleep, the wake up source is BLE timer");
 
@@ -659,19 +677,21 @@ esp_err_t controller_sleep_init(void)
     sleep_modem_register_mac_bb_module_prepare_callback(sleep_modem_mac_bb_power_down_prepare,
                                                    sleep_modem_mac_bb_power_up_prepare);
 #endif // SOC_PM_RETENTION_HAS_CLOCK_BUG && CONFIG_MAC_BB_PD
-#endif /* CONFIG_FREERTOS_USE_TICKLESS_IDLE */
+#endif /* CONFIG_BT_LE_SLEEP_ENABLE && CONFIG_FREERTOS_USE_TICKLESS_IDLE */
     return rc;
 
+#ifdef CONFIG_PM_ENABLE
 error:
-
-#if CONFIG_FREERTOS_USE_TICKLESS_IDLE
+#endif // CONFIG_PM_ENABLE
+#if CONFIG_BT_LE_SLEEP_ENABLE && CONFIG_FREERTOS_USE_TICKLESS_IDLE
 #if SOC_PM_RETENTION_HAS_CLOCK_BUG && CONFIG_MAC_BB_PD
     sleep_modem_unregister_mac_bb_module_prepare_callback(sleep_modem_mac_bb_power_down_prepare,
                                                      sleep_modem_mac_bb_power_up_prepare);
 #endif // SOC_PM_RETENTION_HAS_CLOCK_BUG && CONFIG_MAC_BB_PD
     esp_sleep_disable_bt_wakeup();
     esp_pm_unregister_inform_out_light_sleep_overhead_callback(sleep_modem_light_sleep_overhead_set);
-#endif /* CONFIG_FREERTOS_USE_TICKLESS_IDLE */
+#endif /* CONFIG_BT_LE_SLEEP_ENABLE && CONFIG_FREERTOS_USE_TICKLESS_IDLE */
+#ifdef CONFIG_PM_ENABLE
     /*lock should release first and then delete*/
     if (s_pm_lock != NULL) {
         esp_pm_lock_delete(s_pm_lock);
@@ -684,7 +704,7 @@ error:
 
 void controller_sleep_deinit(void)
 {
-#if CONFIG_FREERTOS_USE_TICKLESS_IDLE
+#if CONFIG_BT_LE_SLEEP_ENABLE && CONFIG_FREERTOS_USE_TICKLESS_IDLE
 #if SOC_PM_RETENTION_HAS_CLOCK_BUG && CONFIG_MAC_BB_PD
     sleep_modem_unregister_mac_bb_module_prepare_callback(sleep_modem_mac_bb_power_down_prepare,
                                                      sleep_modem_mac_bb_power_up_prepare);
@@ -693,7 +713,7 @@ void controller_sleep_deinit(void)
     esp_sleep_disable_bt_wakeup();
     sleep_modem_ble_mac_modem_state_deinit();
     esp_pm_unregister_inform_out_light_sleep_overhead_callback(sleep_modem_light_sleep_overhead_set);
-#endif /* CONFIG_FREERTOS_USE_TICKLESS_IDLE */
+#endif /* CONFIG_BT_LE_SLEEP_ENABLE && CONFIG_FREERTOS_USE_TICKLESS_IDLE */
 #ifdef CONFIG_PM_ENABLE
     /* lock should be released first */
     esp_pm_lock_delete(s_pm_lock);
@@ -1029,6 +1049,10 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
     coex_enable();
 #endif // CONFIG_SW_COEXIST_ENABLE
 
+#if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+    r_ble_ll_scan_start_time_init_compensation(500);
+    r_priv_sdk_config_insert_proc_time_set(500);
+#endif // CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
     if (r_ble_controller_enable(mode) != 0) {
         ret = ESP_FAIL;
         goto error;
@@ -1189,12 +1213,20 @@ esp_err_t esp_ble_tx_power_set(esp_ble_power_type_t power_type, esp_power_level_
 
     switch (power_type) {
     case ESP_BLE_PWR_TYPE_DEFAULT:
-    case ESP_BLE_PWR_TYPE_ADV:
-    case ESP_BLE_PWR_TYPE_SCAN:
         if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
             stat = ESP_OK;
         }
         break;
+    case ESP_BLE_PWR_TYPE_ADV:
+        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_ADV, 0xFF, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
+    case ESP_BLE_PWR_TYPE_SCAN:
+        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
     case ESP_BLE_PWR_TYPE_CONN_HDL0:
     case ESP_BLE_PWR_TYPE_CONN_HDL1:
     case ESP_BLE_PWR_TYPE_CONN_HDL2:
@@ -1222,9 +1254,13 @@ esp_err_t esp_ble_tx_power_set_enhanced(esp_ble_enhanced_power_type_t power_type
     esp_err_t stat = ESP_FAIL;
     switch (power_type) {
     case ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT:
+        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
     case ESP_BLE_ENHANCED_PWR_TYPE_SCAN:
     case ESP_BLE_ENHANCED_PWR_TYPE_INIT:
-        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
+        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0, power_level) == 0) {
             stat = ESP_OK;
         }
         break;
@@ -1247,11 +1283,15 @@ esp_power_level_t esp_ble_tx_power_get(esp_ble_power_type_t power_type)
     int tx_level = 0;
 
     switch (power_type) {
-    case ESP_BLE_PWR_TYPE_ADV:
-    case ESP_BLE_PWR_TYPE_SCAN:
     case ESP_BLE_PWR_TYPE_DEFAULT:
         tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
         break;
+    case ESP_BLE_PWR_TYPE_ADV:
+        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_ADV, 0);
+        break;
+    case ESP_BLE_PWR_TYPE_SCAN:
+        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0);
+        break;
     case ESP_BLE_PWR_TYPE_CONN_HDL0:
     case ESP_BLE_PWR_TYPE_CONN_HDL1:
     case ESP_BLE_PWR_TYPE_CONN_HDL2:
@@ -1281,9 +1321,11 @@ esp_power_level_t esp_ble_tx_power_get_enhanced(esp_ble_enhanced_power_type_t po
 
     switch (power_type) {
     case ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT:
+        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
+        break;
     case ESP_BLE_ENHANCED_PWR_TYPE_SCAN:
     case ESP_BLE_ENHANCED_PWR_TYPE_INIT:
-        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
+        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0);
         break;
     case ESP_BLE_ENHANCED_PWR_TYPE_ADV:
     case ESP_BLE_ENHANCED_PWR_TYPE_CONN:

components/bt/controller/esp32c6/esp_bt_cfg.h

@@ -148,6 +148,12 @@ extern "C" {
 
 #define DEFAULT_BT_LE_COEX_PHY_CODED_TX_RX_TLIM_EFF CONFIG_BT_LE_COEX_PHY_CODED_TX_RX_TLIM_EFF
 
+#ifdef CONFIG_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
+#define DEFAULT_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS  (CONFIG_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS)
+#else
+#define DEFAULT_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS  (0)
+#endif
+
 #ifdef CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #define HCI_UART_EN CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #else
@@ -218,7 +224,6 @@ extern "C" {
 
 #define BLE_LL_TX_PWR_DBM_N                 (CONFIG_BT_LE_DFT_TX_POWER_LEVEL_DBM_EFF)
 
-
 #define RUN_BQB_TEST                        (0)
 #define RUN_QA_TEST                         (0)
 #define NIMBLE_DISABLE_SCAN_BACKOFF         (0)

components/bt/controller/esp32h2/Kconfig.in

@@ -690,3 +690,19 @@ config BT_LE_DFT_TX_POWER_LEVEL_DBM_EFF
     default 18 if BT_LE_DFT_TX_POWER_LEVEL_P18
     default 20 if BT_LE_DFT_TX_POWER_LEVEL_P20
     default 0
+
+config BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
+    bool "Enable enhanced Access Address check in CONNECT_IND"
+    default n
+    help
+        Enabling this option will add stricter verification of the Access Address in the CONNECT_IND PDU.
+        This improves security by ensuring that only connection requests with valid Access Addresses are accepted.
+        If disabled, only basic checks are applied, improving compatibility.
+
+config BT_CTRL_RUN_IN_FLASH_ONLY
+    bool "Reduce BLE IRAM usage (READ DOCS FIRST) (EXPERIMENTAL)"
+    default n
+    help
+        Move most IRAM into flash. This will increase the usage of flash and reduce ble performance.
+        Because the code is moved to the flash, the execution speed of the code is reduced.
+        To have a small impact on performance, you need to enable flash suspend (SPI_FLASH_AUTO_SUSPEND).

components/bt/controller/esp32h2/bt.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -125,6 +125,10 @@ extern void r_ble_lll_rfmgmt_set_sleep_cb(void *s_cb, void *w_cb, void *s_arg,
 extern void r_ble_rtc_wake_up_state_clr(void);
 extern int os_msys_init(void);
 extern void os_msys_deinit(void);
+#if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+extern void r_ble_ll_scan_start_time_init_compensation(uint32_t init_compensation);
+extern void r_priv_sdk_config_insert_proc_time_set(uint16_t insert_proc_time);
+#endif // CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
 #if CONFIG_FREERTOS_USE_TICKLESS_IDLE
 extern sleep_retention_entries_config_t *r_esp_ble_mac_retention_link_get(uint8_t *size, uint8_t extra);
 extern void r_esp_ble_set_wakeup_overhead(uint32_t overhead);
@@ -385,10 +389,20 @@ void esp_bt_read_ctrl_log_from_flash(bool output)
 static bool s_ble_active = false;
 #ifdef CONFIG_PM_ENABLE
 static DRAM_ATTR esp_pm_lock_handle_t s_pm_lock = NULL;
-#define BTDM_MIN_TIMER_UNCERTAINTY_US      (200)
 #endif // CONFIG_PM_ENABLE
 static DRAM_ATTR modem_clock_lpclk_src_t s_bt_lpclk_src = MODEM_CLOCK_LPCLK_SRC_INVALID;
 
+#define BLE_CONTROLLER_MALLOC_CAPS          (MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT|MALLOC_CAP_DMA)
+void *malloc_ble_controller_mem(size_t size)
+{
+    return heap_caps_malloc(size, BLE_CONTROLLER_MALLOC_CAPS);
+}
+
+uint32_t get_ble_controller_free_heap_size(void)
+{
+    return heap_caps_get_free_size(BLE_CONTROLLER_MALLOC_CAPS);
+}
+
 #define BLE_RTC_DELAY_US_LIGHT_SLEEP                    (5100)
 #define BLE_RTC_DELAY_US_MODEM_SLEEP                    (1500)
 
@@ -485,8 +499,11 @@ static int esp_ecc_gen_dh_key(const uint8_t *peer_pub_key_x, const uint8_t *peer
 static int esp_intr_alloc_wrapper(int source, int flags, intr_handler_t handler,
                                   void *arg, void **ret_handle_in)
 {
-    int rc = esp_intr_alloc(source, flags | ESP_INTR_FLAG_IRAM, handler,
-                            arg, (intr_handle_t *)ret_handle_in);
+#if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+    int rc = esp_intr_alloc(source, flags, handler, arg, (intr_handle_t *)ret_handle_in);
+#else
+    int rc = esp_intr_alloc(source, flags | ESP_INTR_FLAG_IRAM, handler, arg, (intr_handle_t *)ret_handle_in);
+#endif
     return rc;
 }
 
@@ -604,7 +621,7 @@ static void sleep_modem_ble_mac_modem_state_deinit(void)
     }
 }
 
-void sleep_modem_light_sleep_overhead_set(uint32_t overhead)
+void IRAM_ATTR sleep_modem_light_sleep_overhead_set(uint32_t overhead)
 {
     r_esp_ble_set_wakeup_overhead(overhead);
 }
@@ -631,13 +648,17 @@ esp_err_t controller_sleep_init(void)
     if (rc != ESP_OK) {
         goto error;
     }
-
     rc = esp_deep_sleep_register_hook(&r_esp_ble_stop_wakeup_timing);
-    assert(rc == 0);
-#if CONFIG_FREERTOS_USE_TICKLESS_IDLE
+    if (rc != ESP_OK) {
+        goto error;
+    }
+#endif //CONFIG_PM_ENABLE
+#if CONFIG_BT_LE_SLEEP_ENABLE && CONFIG_FREERTOS_USE_TICKLESS_IDLE
     /* Create a new regdma link for BLE related register restoration */
     rc = sleep_modem_ble_mac_modem_state_init(0);
-    assert(rc == 0);
+    if (rc != ESP_OK) {
+        goto error;
+    }
     esp_sleep_enable_bt_wakeup();
     ESP_LOGW(NIMBLE_PORT_LOG_TAG, "Enable light sleep, the wake up source is BLE timer");
 
@@ -645,15 +666,17 @@ esp_err_t controller_sleep_init(void)
     if (rc != ESP_OK) {
         goto error;
     }
-#endif /* CONFIG_FREERTOS_USE_TICKLESS_IDLE */
+#endif /* CONFIG_BT_LE_SLEEP_ENABLE && CONFIG_FREERTOS_USE_TICKLESS_IDLE */
     return rc;
 
+#ifdef CONFIG_PM_ENABLE
 error:
-
-#if CONFIG_FREERTOS_USE_TICKLESS_IDLE
+#endif // CONFIG_PM_ENABLE
+#if CONFIG_BT_LE_SLEEP_ENABLE && CONFIG_FREERTOS_USE_TICKLESS_IDLE
     esp_sleep_disable_bt_wakeup();
     esp_pm_unregister_inform_out_light_sleep_overhead_callback(sleep_modem_light_sleep_overhead_set);
-#endif /* CONFIG_FREERTOS_USE_TICKLESS_IDLE */
+#endif /* CONFIG_BT_LE_SLEEP_ENABLE && CONFIG_FREERTOS_USE_TICKLESS_IDLE */
+#ifdef CONFIG_PM_ENABLE
     esp_deep_sleep_deregister_hook(&r_esp_ble_stop_wakeup_timing);
     /*lock should release first and then delete*/
     if (s_pm_lock != NULL) {
@@ -667,12 +690,12 @@ error:
 
 void controller_sleep_deinit(void)
 {
-#if CONFIG_FREERTOS_USE_TICKLESS_IDLE
+#if CONFIG_BT_LE_SLEEP_ENABLE && CONFIG_FREERTOS_USE_TICKLESS_IDLE
     r_ble_rtc_wake_up_state_clr();
     esp_sleep_disable_bt_wakeup();
     sleep_modem_ble_mac_modem_state_deinit();
     esp_pm_unregister_inform_out_light_sleep_overhead_callback(sleep_modem_light_sleep_overhead_set);
-#endif /* CONFIG_FREERTOS_USE_TICKLESS_IDLE */
+#endif /* CONFIG_BT_LE_SLEEP_ENABLE && CONFIG_FREERTOS_USE_TICKLESS_IDLE */
 #ifdef CONFIG_PM_ENABLE
     esp_deep_sleep_deregister_hook(&r_esp_ble_stop_wakeup_timing);
     /* lock should be released first */
@@ -1004,7 +1027,10 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
 #if CONFIG_SW_COEXIST_ENABLE
     coex_enable();
 #endif // CONFIG_SW_COEXIST_ENABLE
-
+#if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+    r_ble_ll_scan_start_time_init_compensation(500);
+    r_priv_sdk_config_insert_proc_time_set(500);
+#endif // CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
     if (r_ble_controller_enable(mode) != 0) {
         ret = ESP_FAIL;
         goto error;
@@ -1165,12 +1191,20 @@ esp_err_t esp_ble_tx_power_set(esp_ble_power_type_t power_type, esp_power_level_
 
     switch (power_type) {
     case ESP_BLE_PWR_TYPE_DEFAULT:
-    case ESP_BLE_PWR_TYPE_ADV:
-    case ESP_BLE_PWR_TYPE_SCAN:
         if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
             stat = ESP_OK;
         }
         break;
+    case ESP_BLE_PWR_TYPE_ADV:
+        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_ADV, 0xFF, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
+    case ESP_BLE_PWR_TYPE_SCAN:
+        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
     case ESP_BLE_PWR_TYPE_CONN_HDL0:
     case ESP_BLE_PWR_TYPE_CONN_HDL1:
     case ESP_BLE_PWR_TYPE_CONN_HDL2:
@@ -1198,9 +1232,13 @@ esp_err_t esp_ble_tx_power_set_enhanced(esp_ble_enhanced_power_type_t power_type
     esp_err_t stat = ESP_FAIL;
     switch (power_type) {
     case ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT:
+        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
     case ESP_BLE_ENHANCED_PWR_TYPE_SCAN:
     case ESP_BLE_ENHANCED_PWR_TYPE_INIT:
-        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
+        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0, power_level) == 0) {
             stat = ESP_OK;
         }
         break;
@@ -1223,11 +1261,15 @@ esp_power_level_t esp_ble_tx_power_get(esp_ble_power_type_t power_type)
     int tx_level = 0;
 
     switch (power_type) {
-    case ESP_BLE_PWR_TYPE_ADV:
-    case ESP_BLE_PWR_TYPE_SCAN:
     case ESP_BLE_PWR_TYPE_DEFAULT:
         tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
         break;
+    case ESP_BLE_PWR_TYPE_ADV:
+        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_ADV, 0);
+        break;
+    case ESP_BLE_PWR_TYPE_SCAN:
+        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0);
+        break;
     case ESP_BLE_PWR_TYPE_CONN_HDL0:
     case ESP_BLE_PWR_TYPE_CONN_HDL1:
     case ESP_BLE_PWR_TYPE_CONN_HDL2:
@@ -1257,9 +1299,11 @@ esp_power_level_t esp_ble_tx_power_get_enhanced(esp_ble_enhanced_power_type_t po
 
     switch (power_type) {
     case ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT:
+        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
+        break;
     case ESP_BLE_ENHANCED_PWR_TYPE_SCAN:
     case ESP_BLE_ENHANCED_PWR_TYPE_INIT:
-        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
+        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0);
         break;
     case ESP_BLE_ENHANCED_PWR_TYPE_ADV:
     case ESP_BLE_ENHANCED_PWR_TYPE_CONN:

components/bt/controller/esp32h2/esp_bt_cfg.h

@@ -148,6 +148,12 @@ extern "C" {
 
 #define DEFAULT_BT_LE_COEX_PHY_CODED_TX_RX_TLIM_EFF CONFIG_BT_LE_COEX_PHY_CODED_TX_RX_TLIM_EFF
 
+#ifdef CONFIG_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
+#define DEFAULT_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS  (CONFIG_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS)
+#else
+#define DEFAULT_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS  (0)
+#endif
+
 #ifdef CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #define HCI_UART_EN CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #else

components/bt/esp_ble_mesh/Kconfig.in

@@ -6,9 +6,16 @@ if BLE_MESH
         help
             It is a temporary solution and needs further modifications.
 
+    config BLE_MESH_V11_SUPPORT
+        bool "Support ESP BLE Mesh v1.1 features (Preview)"
+        default y
+        help
+            Support BLE Mesh v1.1 features
+
     config BLE_MESH_RANDOM_ADV_INTERVAL
         bool "Support using random adv interval for mesh packets"
         select BT_BLE_HIGH_DUTY_ADV_INTERVAL if BT_BLUEDROID_ENABLED
+        select BT_NIMBLE_HIGH_DUTY_ADV_ITVL if BT_NIMBLE_ENABLED
         default n
         help
             Enable this option to allow using random advertising interval
@@ -33,6 +40,7 @@ if BLE_MESH
 
     config BLE_MESH_ACTIVE_SCAN
         bool "Support Active Scan in BLE Mesh"
+        depends on BLE_MESH_V11_SUPPORT
         help
             Enable this option to allow using BLE Active Scan for BLE Mesh.
 
@@ -282,6 +290,7 @@ if BLE_MESH
     config BLE_MESH_PROV_EPA
         bool "BLE Mesh enhanced provisioning authentication"
         depends on BLE_MESH_PROV
+        depends on BLE_MESH_V11_SUPPORT
         default y
         help
             Enable this option to support BLE Mesh enhanced provisioning authentication
@@ -291,6 +300,7 @@ if BLE_MESH
     config BLE_MESH_CERT_BASED_PROV
         bool "Support Certificate-based provisioning"
         depends on BLE_MESH_PROV
+        depends on BLE_MESH_V11_SUPPORT
         default n
         help
             Enable this option to support BLE Mesh Certificate-Based Provisioning.
@@ -391,6 +401,7 @@ if BLE_MESH
     config BLE_MESH_PROXY_SOLIC_PDU_RX
         bool "Support receiving Proxy Solicitation PDU"
         depends on BLE_MESH_GATT_PROXY_SERVER
+        depends on BLE_MESH_V11_SUPPORT
         help
             Enable this option to support receiving Proxy Solicitation PDU.
 
@@ -418,6 +429,7 @@ if BLE_MESH
     config BLE_MESH_PROXY_SOLIC_PDU_TX
         bool "Support sending Proxy Solicitation PDU"
         depends on BLE_MESH_GATT_PROXY_CLIENT
+        depends on BLE_MESH_V11_SUPPORT
         help
             Enable this option to support sending Proxy Solicitation PDU.
 
@@ -704,6 +716,7 @@ if BLE_MESH
             to perform the IV index recovery procedure.
 
     config BLE_MESH_SAR_ENHANCEMENT
+        depends on BLE_MESH_V11_SUPPORT
         bool "Segmentation and reassembly enhancement"
         default n
         help
@@ -1103,253 +1116,257 @@ if BLE_MESH
             help
                 Enable support for Health Server model.
 
-        config BLE_MESH_BRC_CLI
-            bool "Bridge Configuration Client model"
-            help
-                Enable support for Bridge Configuration Client model.
+        if BLE_MESH_V11_SUPPORT
 
-        config BLE_MESH_BRC_SRV
-            bool "Bridge Configuration Server model"
-            default n
-            help
-                Enable support for Bridge Configuration Server model.
-
-        if BLE_MESH_BRC_SRV
-
-            config BLE_MESH_MAX_BRIDGING_TABLE_ENTRY_COUNT
-                int "Maximum number of Bridging Table entries"
-                range 16 65535
-                default 16
+            config BLE_MESH_BRC_CLI
+                bool "Bridge Configuration Client model"
                 help
-                    Maximum number of Bridging Table entries that the Bridge Configuration Server can support.
+                    Enable support for Bridge Configuration Client model.
 
-            config BLE_MESH_BRIDGE_CRPL
-                int "Maximum capacity of bridge replay protection list"
-                default 5
-                range 1 255
-                help
-                    This option specifies the maximum capacity of the bridge replay
-                    protection list. The bridge replay protection list is used to
-                    prevent a bridged subnet from replay attack, which will store the
-                    source address and sequence number of the received bridge messages.
-
-        endif #BLE_MESH_BRC_SRV
-
-        config BLE_MESH_PRB_CLI
-            bool "Mesh Private Beacon Client model"
-            help
-                Enable support for Mesh Private Beacon Client model.
-
-        config BLE_MESH_PRB_SRV
-            bool "Mesh Private Beacon Server model"
-            help
-                Enable support for Mesh Private Beacon Server model.
-
-        config BLE_MESH_ODP_CLI
-            bool "On-Demand Private Proxy Client model"
-            help
-                Enable support for On-Demand Private Proxy Client model.
-
-        config BLE_MESH_ODP_SRV
-            bool "On-Demand Private Proxy Server model"
-            depends on BLE_MESH_PROXY_SOLIC_PDU_RX
-            select BLE_MESH_SRPL_SRV
-            help
-                Enable support for On-Demand Private Proxy Server model.
-
-        config BLE_MESH_SRPL_CLI
-            bool "Solicitation PDU RPL Configuration Client model"
-            help
-                Enable support for Solicitation PDU RPL Configuration Client model.
-
-        config BLE_MESH_SRPL_SRV
-            bool "Solicitation PDU RPL Configuration Server model"
-            depends on BLE_MESH_PROXY_SOLIC_PDU_RX
-            help
-                Enable support for Solicitation PDU RPL Configuration Server model.
-                Note:
-                This option depends on the functionality of receiving Solicitation
-                PDU. If the device doesn't support receiving Solicitation PDU, then
-                there is no need to enable this server model.
-
-        config BLE_MESH_AGG_CLI
-            bool "Opcodes Aggregator Client model"
-            help
-                Enable support for Opcodes Aggregator Client model.
-
-        config BLE_MESH_AGG_SRV
-            bool "Opcodes Aggregator Server model"
-            help
-                Enable support for Opcodes Aggregator Server model.
-
-        config BLE_MESH_SAR_CLI
-            bool "SAR Configuration Client model"
-            help
-                Enable support for SAR Configuration Client model.
-
-        config BLE_MESH_SAR_SRV
-            bool "SAR Configuration Server model"
-            help
-                Enable support for SAR Configuration Server model.
-
-        config BLE_MESH_COMP_DATA_1
-            bool "Support Composition Data Page 1"
-            help
-                Composition Data Page 1 contains information about the relationships
-                among models.
-                Each model either can be a root model or can extend other models.
-
-        config BLE_MESH_COMP_DATA_128
-            bool "Support Composition Data Page 128"
-            help
-                Composition Data Page 128 is used to indicate the structure of
-                elements, features, and models of a node after the successful
-                execution of the Node Address Refresh procedure or the Node
-                Composition Refresh procedure, or after the execution of the
-                Node Removal procedure followed by the provisioning process.
-                Composition Data Page 128 shall be present if the node supports
-                the Remote Provisioning Server model; otherwise it is optional.
-
-        config BLE_MESH_MODELS_METADATA_0
-            bool "Support Models Metadata Page 0"
-            help
-                The Models Metadata state contains metadata of a node’s models.
-                The Models Metadata state is composed of a number of pages of
-                information.
-                Models Metadata Page 0 shall be present if the node supports
-                the Large Composition Data Server model.
-
-        config BLE_MESH_MODELS_METADATA_128
-            bool "Support Models Metadata Page 128"
-            depends on BLE_MESH_MODELS_METADATA_0
-            help
-                The Models Metadata state contains metadata of a node’s models.
-                The Models Metadata state is composed of a number of pages of
-                information.
-                Models Metadata Page 128 contains metadata for the node’s models
-                after the successful execution of the Node Address Refresh
-                procedure or the Node Composition Refresh procedure, or after
-                the execution of the Node Removal procedure followed by the
-                provisioning process.
-                Models Metadata Page 128 shall be present if the node supports
-                the Remote Provisioning Server model and the node supports the
-                Large Composition Data Server model.
-
-        config BLE_MESH_LCD_CLI
-            bool "Large Composition Data Client model"
-            help
-                Enable support for Large Composition Data Client model.
-
-        config BLE_MESH_LCD_SRV
-            bool "Large Composition Data Server model"
-            select BLE_MESH_MODELS_METADATA_0
-            help
-                Enable support for Large Composition Data Server model.
-
-        config BLE_MESH_RPR_CLI
-            bool "Remote Provisioning Client model"
-            depends on BLE_MESH_PROVISIONER
-            select BLE_MESH_PROV
-            help
-                Enable support for Remote Provisioning Client model
-
-        if BLE_MESH_RPR_CLI
-
-            config BLE_MESH_RPR_CLI_PROV_SAME_TIME
-                int "Maximum number of PB-Remote running at the same time by Provisioner"
-                range 1 5
-                default 2
-                help
-                    This option specifies how many devices can be provisioned at the same time
-                    using PB-REMOTE. For example, if the value is 2, it means a Provisioner can
-                    provision two unprovisioned devices with PB-REMOTE at the same time.
-
-        endif # BLE_MESH_RPR_CLI
-
-        config BLE_MESH_RPR_SRV
-            bool "Remote Provisioning Server model"
-            depends on BLE_MESH_NODE
-            select BLE_MESH_PB_ADV
-            help
-                Enable support for Remote Provisioning Server model
-
-        if BLE_MESH_RPR_SRV
-
-            config BLE_MESH_RPR_SRV_MAX_SCANNED_ITEMS
-                int "Maximum number of device information can be scanned"
-                range 4 255
-                default 10
-                help
-                    This option specifies how many device information can a Remote
-                    Provisioning Server store each time while scanning.
-
-            config BLE_MESH_RPR_SRV_ACTIVE_SCAN
-                bool "Support Active Scan for remote provisioning"
-                select BLE_MESH_ACTIVE_SCAN
-                help
-                    Enable this option to support Active Scan for remote provisioning.
-
-            config BLE_MESH_RPR_SRV_MAX_EXT_SCAN
-                int "Maximum number of extended scan procedures"
-                range 1 10
-                default 1
-                help
-                    This option specifies how many extended scan procedures can be
-                    started by the Remote Provisioning Server.
-
-        endif # BLE_MESH_RPR_SRV
-
-        config BLE_MESH_DF_CLI
-            bool "Directed Forwarding Configuration Client model"
-            help
-                Enable support for Directed Forwarding Configuration Client model.
-
-        config BLE_MESH_DF_SRV
-            bool "Directed Forwarding Configuration Server model"
-            help
-                Enable support for Directed Forwarding Configuration Server model.
-
-        if BLE_MESH_DF_SRV
-
-            config BLE_MESH_MAX_DISC_TABLE_ENTRY_COUNT
-                int "Maximum number of discovery table entries in a given subnet"
-                range 2 255
-                default 2
-                help
-                    Maximum number of Discovery Table entries supported by the node in a given subnet.
-
-            config BLE_MESH_MAX_FORWARD_TABLE_ENTRY_COUNT
-                int "Maximum number of forward table entries in a given subnet"
-                range 2 64
-                default 2
-                help
-                    Maximum number of Forward Table entries supported by the node in a given subnet.
-
-            config BLE_MESH_MAX_DEPS_NODES_PER_PATH
-                int "Maximum number of dependent nodes per path"
-                range 2 64
-                default 2
-                help
-                    Maximum size of dependent nodes list supported by each forward table entry.
-
-            config BLE_MESH_PATH_MONITOR_TEST
-                bool "Enable Path Monitoring test mode"
+            config BLE_MESH_BRC_SRV
+                bool "Bridge Configuration Server model"
                 default n
                 help
-                    The option only removes the Path Use timer; all other behavior of the
-                    device is not changed.
-                    If Path Monitoring test mode is going to be used, this option should
-                    be enabled.
+                    Enable support for Bridge Configuration Server model.
 
-            if BLE_MESH_GATT_PROXY_SERVER
-                config BLE_MESH_SUPPORT_DIRECTED_PROXY
-                    bool "Enable Directed Proxy functionality"
-                    default y
+            if BLE_MESH_BRC_SRV
+
+                config BLE_MESH_MAX_BRIDGING_TABLE_ENTRY_COUNT
+                    int "Maximum number of Bridging Table entries"
+                    range 16 65535
+                    default 16
                     help
-                        Support Directed Proxy functionality.
-            endif
+                        Maximum number of Bridging Table entries that the Bridge Configuration Server can support.
 
-        endif # BLE_MESH_DF_SRV
+                config BLE_MESH_BRIDGE_CRPL
+                    int "Maximum capacity of bridge replay protection list"
+                    default 5
+                    range 1 255
+                    help
+                        This option specifies the maximum capacity of the bridge replay
+                        protection list. The bridge replay protection list is used to
+                        prevent a bridged subnet from replay attack, which will store the
+                        source address and sequence number of the received bridge messages.
+
+            endif #BLE_MESH_BRC_SRV
+
+            config BLE_MESH_PRB_CLI
+                bool "Mesh Private Beacon Client model"
+                help
+                    Enable support for Mesh Private Beacon Client model.
+
+            config BLE_MESH_PRB_SRV
+                bool "Mesh Private Beacon Server model"
+                help
+                    Enable support for Mesh Private Beacon Server model.
+
+            config BLE_MESH_ODP_CLI
+                bool "On-Demand Private Proxy Client model"
+                help
+                    Enable support for On-Demand Private Proxy Client model.
+
+            config BLE_MESH_ODP_SRV
+                bool "On-Demand Private Proxy Server model"
+                depends on BLE_MESH_PROXY_SOLIC_PDU_RX
+                select BLE_MESH_SRPL_SRV
+                help
+                    Enable support for On-Demand Private Proxy Server model.
+
+            config BLE_MESH_SRPL_CLI
+                bool "Solicitation PDU RPL Configuration Client model"
+                help
+                    Enable support for Solicitation PDU RPL Configuration Client model.
+
+            config BLE_MESH_SRPL_SRV
+                bool "Solicitation PDU RPL Configuration Server model"
+                depends on BLE_MESH_PROXY_SOLIC_PDU_RX
+                help
+                    Enable support for Solicitation PDU RPL Configuration Server model.
+                    Note:
+                    This option depends on the functionality of receiving Solicitation
+                    PDU. If the device doesn't support receiving Solicitation PDU, then
+                    there is no need to enable this server model.
+
+            config BLE_MESH_AGG_CLI
+                bool "Opcodes Aggregator Client model"
+                help
+                    Enable support for Opcodes Aggregator Client model.
+
+            config BLE_MESH_AGG_SRV
+                bool "Opcodes Aggregator Server model"
+                help
+                    Enable support for Opcodes Aggregator Server model.
+
+            config BLE_MESH_SAR_CLI
+                bool "SAR Configuration Client model"
+                help
+                    Enable support for SAR Configuration Client model.
+
+            config BLE_MESH_SAR_SRV
+                bool "SAR Configuration Server model"
+                help
+                    Enable support for SAR Configuration Server model.
+
+            config BLE_MESH_COMP_DATA_1
+                bool "Support Composition Data Page 1"
+                help
+                    Composition Data Page 1 contains information about the relationships
+                    among models.
+                    Each model either can be a root model or can extend other models.
+
+            config BLE_MESH_COMP_DATA_128
+                bool "Support Composition Data Page 128"
+                help
+                    Composition Data Page 128 is used to indicate the structure of
+                    elements, features, and models of a node after the successful
+                    execution of the Node Address Refresh procedure or the Node
+                    Composition Refresh procedure, or after the execution of the
+                    Node Removal procedure followed by the provisioning process.
+                    Composition Data Page 128 shall be present if the node supports
+                    the Remote Provisioning Server model; otherwise it is optional.
+
+            config BLE_MESH_MODELS_METADATA_0
+                bool "Support Models Metadata Page 0"
+                help
+                    The Models Metadata state contains metadata of a node’s models.
+                    The Models Metadata state is composed of a number of pages of
+                    information.
+                    Models Metadata Page 0 shall be present if the node supports
+                    the Large Composition Data Server model.
+
+            config BLE_MESH_MODELS_METADATA_128
+                bool "Support Models Metadata Page 128"
+                depends on BLE_MESH_MODELS_METADATA_0
+                help
+                    The Models Metadata state contains metadata of a node’s models.
+                    The Models Metadata state is composed of a number of pages of
+                    information.
+                    Models Metadata Page 128 contains metadata for the node’s models
+                    after the successful execution of the Node Address Refresh
+                    procedure or the Node Composition Refresh procedure, or after
+                    the execution of the Node Removal procedure followed by the
+                    provisioning process.
+                    Models Metadata Page 128 shall be present if the node supports
+                    the Remote Provisioning Server model and the node supports the
+                    Large Composition Data Server model.
+
+            config BLE_MESH_LCD_CLI
+                bool "Large Composition Data Client model"
+                help
+                    Enable support for Large Composition Data Client model.
+
+            config BLE_MESH_LCD_SRV
+                bool "Large Composition Data Server model"
+                select BLE_MESH_MODELS_METADATA_0
+                help
+                    Enable support for Large Composition Data Server model.
+
+            config BLE_MESH_RPR_CLI
+                bool "Remote Provisioning Client model"
+                depends on BLE_MESH_PROVISIONER
+                select BLE_MESH_PROV
+                help
+                    Enable support for Remote Provisioning Client model
+
+            if BLE_MESH_RPR_CLI
+
+                config BLE_MESH_RPR_CLI_PROV_SAME_TIME
+                    int "Maximum number of PB-Remote running at the same time by Provisioner"
+                    range 1 5
+                    default 2
+                    help
+                        This option specifies how many devices can be provisioned at the same time
+                        using PB-REMOTE. For example, if the value is 2, it means a Provisioner can
+                        provision two unprovisioned devices with PB-REMOTE at the same time.
+
+            endif # BLE_MESH_RPR_CLI
+
+            config BLE_MESH_RPR_SRV
+                bool "Remote Provisioning Server model"
+                depends on BLE_MESH_NODE
+                select BLE_MESH_PB_ADV
+                help
+                    Enable support for Remote Provisioning Server model
+
+            if BLE_MESH_RPR_SRV
+
+                config BLE_MESH_RPR_SRV_MAX_SCANNED_ITEMS
+                    int "Maximum number of device information can be scanned"
+                    range 4 255
+                    default 10
+                    help
+                        This option specifies how many device information can a Remote
+                        Provisioning Server store each time while scanning.
+
+                config BLE_MESH_RPR_SRV_ACTIVE_SCAN
+                    bool "Support Active Scan for remote provisioning"
+                    select BLE_MESH_ACTIVE_SCAN
+                    help
+                        Enable this option to support Active Scan for remote provisioning.
+
+                config BLE_MESH_RPR_SRV_MAX_EXT_SCAN
+                    int "Maximum number of extended scan procedures"
+                    range 1 10
+                    default 1
+                    help
+                        This option specifies how many extended scan procedures can be
+                        started by the Remote Provisioning Server.
+
+            endif # BLE_MESH_RPR_SRV
+
+            config BLE_MESH_DF_CLI
+                bool "Directed Forwarding Configuration Client model"
+                help
+                    Enable support for Directed Forwarding Configuration Client model.
+
+            config BLE_MESH_DF_SRV
+                bool "Directed Forwarding Configuration Server model"
+                help
+                    Enable support for Directed Forwarding Configuration Server model.
+
+            if BLE_MESH_DF_SRV
+
+                config BLE_MESH_MAX_DISC_TABLE_ENTRY_COUNT
+                    int "Maximum number of discovery table entries in a given subnet"
+                    range 2 255
+                    default 2
+                    help
+                        Maximum number of Discovery Table entries supported by the node in a given subnet.
+
+                config BLE_MESH_MAX_FORWARD_TABLE_ENTRY_COUNT
+                    int "Maximum number of forward table entries in a given subnet"
+                    range 2 64
+                    default 2
+                    help
+                        Maximum number of Forward Table entries supported by the node in a given subnet.
+
+                config BLE_MESH_MAX_DEPS_NODES_PER_PATH
+                    int "Maximum number of dependent nodes per path"
+                    range 2 64
+                    default 2
+                    help
+                        Maximum size of dependent nodes list supported by each forward table entry.
+
+                config BLE_MESH_PATH_MONITOR_TEST
+                    bool "Enable Path Monitoring test mode"
+                    default n
+                    help
+                        The option only removes the Path Use timer; all other behavior of the
+                        device is not changed.
+                        If Path Monitoring test mode is going to be used, this option should
+                        be enabled.
+
+                if BLE_MESH_GATT_PROXY_SERVER
+                    config BLE_MESH_SUPPORT_DIRECTED_PROXY
+                        bool "Enable Directed Proxy functionality"
+                        default y
+                        help
+                            Support Directed Proxy functionality.
+                endif
+
+            endif # BLE_MESH_DF_SRV
+
+        endif # BLE_MESH_V11_SUPPORT
 
     endmenu #Support for BLE Mesh Foundation models
 
@@ -1466,6 +1483,7 @@ if BLE_MESH
 
         config BLE_MESH_MBT_CLI
             bool "BLOB Transfer Client model"
+            depends on BLE_MESH_V11_SUPPORT
             default n
             help
                 Enable support for BLOB Transfer Client model.
@@ -1484,6 +1502,7 @@ if BLE_MESH
 
         config BLE_MESH_MBT_SRV
             bool "BLOB Transfer Server model"
+            depends on BLE_MESH_V11_SUPPORT
             default n
             help
                 Enable support for BLOB Transfer Server model.

components/bt/esp_ble_mesh/btc/btc_ble_mesh_prov.c

@@ -10,11 +10,13 @@
 #include "btc_ble_mesh_prov.h"
 #include "btc_ble_mesh_config_model.h"
 #include "btc_ble_mesh_health_model.h"
-#include "btc_ble_mesh_prb_model.h"
 #include "btc_ble_mesh_generic_model.h"
 #include "btc_ble_mesh_time_scene_model.h"
 #include "btc_ble_mesh_sensor_model.h"
 #include "btc_ble_mesh_lighting_model.h"
+
+#if CONFIG_BLE_MESH_V11_SUPPORT
+#include "btc_ble_mesh_prb_model.h"
 #include "btc_ble_mesh_brc_model.h"
 #include "btc_ble_mesh_odp_model.h"
 #include "btc_ble_mesh_srpl_model.h"
@@ -24,6 +26,8 @@
 #include "btc_ble_mesh_rpr_model.h"
 #include "btc_ble_mesh_df_model.h"
 #include "btc_ble_mesh_mbt_model.h"
+#include "mesh_v1.1/utils.h"
+#endif /* CONFIG_BLE_MESH_V11_SUPPORT */
 
 #include "adv.h"
 #include "mesh/kernel.h"
@@ -65,8 +69,6 @@
 #include "mesh/state_binding.h"
 #include "local.h"
 
-#include "mesh_v1.1/utils.h"
-
 #include "esp_ble_mesh_common_api.h"
 #include "esp_ble_mesh_provisioning_api.h"
 #include "esp_ble_mesh_networking_api.h"

components/bt/esp_ble_mesh/core/access.c

@@ -2,7 +2,7 @@
 
 /*
  * SPDX-FileCopyrightText: 2017 Intel Corporation
- * SPDX-FileContributor: 2018-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileContributor: 2018-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -11,6 +11,7 @@
 #include <errno.h>
 
 #include "mesh.h"
+#include "tag.h"
 #include "adv.h"
 #include "lpn.h"
 #include "friend.h"
@@ -22,7 +23,9 @@
 #include "fast_prov.h"
 #include "pvnr_mgmt.h"
 
+#if CONFIG_BLE_MESH_V11_SUPPORT
 #include "mesh_v1.1/utils.h"
+#endif
 
 #define BLE_MESH_SDU_MAX_LEN    384
 
@@ -814,6 +817,135 @@ static bool ready_to_send(uint16_t dst)
     return false;
 }
 
+#if !CONFIG_BLE_MESH_V11_SUPPORT
+static bool use_friend_cred(uint16_t net_idx, uint16_t dst)
+{
+    /* Currently LPN only supports using NetKey in bt_mesh.sub[0] */
+    if (IS_ENABLED(CONFIG_BLE_MESH_LOW_POWER) &&
+        net_idx == 0 &&
+        bt_mesh_lpn_match(dst)) {
+        return true;
+    }
+
+    if (IS_ENABLED(CONFIG_BLE_MESH_FRIEND) &&
+        bt_mesh_friend_match(net_idx, dst)) {
+        return true;
+    }
+
+    return false;
+}
+
+bool bt_mesh_valid_security_cred(struct bt_mesh_net_tx *tx)
+{
+    /* If the message is tagged with immutable-credentials,
+     * then the security credentials shall not be changed
+     * in lower layers.
+     * If not, later a better security credentials could be
+     * chosen for the message.
+     */
+    if (!bt_mesh_tag_immutable_cred(tx->ctx->send_tag)) {
+        return true;
+    }
+
+    if (tx->ctx->send_cred > BLE_MESH_FRIENDSHIP_CRED) {
+        return false;
+    }
+
+    if (tx->ctx->send_cred == BLE_MESH_FRIENDSHIP_CRED &&
+        !use_friend_cred(tx->ctx->net_idx, tx->ctx->addr)) {
+        return false;
+    }
+
+    return true;
+}
+
+void bt_mesh_choose_better_security_cred(struct bt_mesh_net_tx *tx)
+{
+    uint8_t send_cred = 0U;
+    uint8_t send_tag = 0U;
+    uint16_t net_idx = 0U;
+    uint16_t addr = 0U;
+
+    send_cred = tx->ctx->send_cred;
+    send_tag = tx->ctx->send_tag;
+    net_idx = tx->ctx->net_idx;
+    addr = tx->ctx->addr;
+
+    /* If the message is tagged with immutable-credentials,
+     * then the security credentials shall not be changed.
+     */
+    if (bt_mesh_tag_immutable_cred(send_tag)) {
+        return;
+    }
+
+    if (send_cred > BLE_MESH_FRIENDSHIP_CRED) {
+        BT_INFO("Use managed flooding security credentials");
+        tx->ctx->send_cred = BLE_MESH_FLOODING_CRED;
+        return;
+    }
+
+    if (send_cred == BLE_MESH_FRIENDSHIP_CRED) {
+        if (!use_friend_cred(net_idx, addr)) {
+            BT_INFO("Use managed flooding security credentials");
+            tx->ctx->send_cred = BLE_MESH_FLOODING_CRED;
+            tx->ctx->send_tag = send_tag | BLE_MESH_TAG_IMMUTABLE_CRED;
+        } else {
+            /* TODO:
+             * For LPN, do we need to change the friendship security
+             * credentials to managed flooding credentials?
+             * If changed, this could increase the possibility that
+             * the corresponding Friend node receives this message.
+             */
+        }
+        return;
+    }
+
+    /* If the message is destinated to a LPN, the following could be
+     * introduced to send the message with the friendship credentials.
+     *
+     * For LPN, this optimization should not be introduced, since it
+     * may cause the message failed to received by the Friend node,
+     * using friendship credentials will make the message can not be
+     * relayed by other mesh nodes.
+     */
+    if (IS_ENABLED(CONFIG_BLE_MESH_FRIEND) &&
+        BLE_MESH_ADDR_IS_UNICAST(addr) &&
+        bt_mesh_friend_match(net_idx, addr)) {
+        BT_INFO("Use friendship security credentials");
+        tx->ctx->send_cred = BLE_MESH_FRIENDSHIP_CRED;
+        tx->ctx->send_tag = send_tag | BLE_MESH_TAG_IMMUTABLE_CRED;
+        return;
+    }
+
+    /**
+     * Spec 3.7.3.1
+     * The Low power node in friendship should use friendship security
+     * material.
+     *
+     * But in Spec 3.6.6.2
+     * Depending on the value of the Publish Friendship Credentials Flag
+     * (see Section 4.2.3.4), the Low Power node model publishes messages
+     * using either the friendship security credentials or the managed
+     * flooding security credentials (see Section 3.9.6.3.1).
+     *
+     * So use the BLE_MESH_TAG_IMMUTABLE_CRED to indicate that the
+     * credentials of the message should not be changed when the
+     * message is sent by model publishing, even though the spec
+     * didn't require this flag to be set when model publishing.
+    */
+
+#if CONFIG_BLE_MESH_LOW_POWER
+    if (BLE_MESH_ADDR_IS_UNICAST(addr) &&
+        bt_mesh.lpn.frnd == addr &&
+        !bt_mesh_tag_immutable_cred(send_tag)) {
+        tx->ctx->send_cred = BLE_MESH_FRIENDSHIP_CRED;
+        tx->ctx->send_tag = send_tag | BLE_MESH_TAG_IMMUTABLE_CRED;
+        return;
+    }
+#endif
+}
+#endif /* !CONFIG_BLE_MESH_V11_SUPPORT */
+
 static int model_send(struct bt_mesh_model *model,
                       struct bt_mesh_net_tx *tx, bool implicit_bind,
                       struct net_buf_simple *msg,
@@ -1108,11 +1240,13 @@ size_t bt_mesh_rx_devkey_size(void)
 #if CONFIG_BLE_MESH_NODE && !CONFIG_BLE_MESH_PROVISIONER
     if (bt_mesh_is_provisioned()) {
         size = 1;
+#if CONFIG_BLE_MESH_RPR_SRV
         if (bt_mesh_dev_key_ca_valid()) {
             size += 1;
         }
+#endif /* CONFIG_BLE_MESH_RPR_SRV */
     }
-#endif
+#endif /* CONFIG_BLE_MESH_NODE && !CONFIG_BLE_MESH_PROVISIONER */
 
 #if !CONFIG_BLE_MESH_NODE && CONFIG_BLE_MESH_PROVISIONER
     if (bt_mesh_is_provisioner_en()) {
@@ -1122,9 +1256,11 @@ size_t bt_mesh_rx_devkey_size(void)
 
 #if CONFIG_BLE_MESH_NODE && CONFIG_BLE_MESH_PROVISIONER
     size = 1;
+#if CONFIG_BLE_MESH_RPR_SRV
     if (bt_mesh_dev_key_ca_valid()) {
         size += 1;
     }
+#endif /* CONFIG_BLE_MESH_RPR_SRV */
     if (bt_mesh_is_provisioner_en()) {
         size += 1;
     }
@@ -1156,7 +1292,9 @@ const uint8_t *bt_mesh_rx_devkey_get(size_t index, uint16_t src)
 #if CONFIG_BLE_MESH_NODE && CONFIG_BLE_MESH_PROVISIONER
     if (index == 0) {
         key = bt_mesh.dev_key;
-    } else if (index == 1 && bt_mesh_dev_key_ca_valid()) {
+    } else
+#if CONFIG_BLE_MESH_RPR_SRV
+    if (index == 1 && bt_mesh_dev_key_ca_valid()) {
         /* If index == 1, there are two cases.
          *  1. bt_mesh_dev_key_ca_valid() is true, it should be return bt_mesh.dev_key_ca.
          *  2. bt_mesh_is_provisioner_en() is true, it should be return bt_mesh_provisioner_dev_key_get(src).
@@ -1166,7 +1304,9 @@ const uint8_t *bt_mesh_rx_devkey_get(size_t index, uint16_t src)
          * Then this round of function bt_mesh_rx_devkey_get(2, src) will return bt_mesh_provisioner_dev_key_get(src).
          */
         key = bt_mesh.dev_key_ca;
-    } else {
+    } else
+#endif
+    {
         key = bt_mesh_provisioner_dev_key_get(src);
     }
 #endif

components/bt/esp_ble_mesh/core/beacon.c

@@ -2,7 +2,7 @@
 
 /*
  * SPDX-FileCopyrightText: 2017 Intel Corporation
- * SPDX-FileContributor: 2018-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileContributor: 2018-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -25,7 +25,9 @@
 #include "pvnr_mgmt.h"
 #include "mesh/common.h"
 
+#if CONFIG_BLE_MESH_V11_SUPPORT
 #include "mesh_v1.1/utils.h"
+#endif
 
 #if defined(CONFIG_BLE_MESH_UNPROVISIONED_BEACON_INTERVAL)
 #define UNPROV_BEACON_INTERVAL     K_SECONDS(CONFIG_BLE_MESH_UNPROVISIONED_BEACON_INTERVAL)
@@ -33,7 +35,11 @@
 #define UNPROV_BEACON_INTERVAL     K_SECONDS(5)
 #endif
 
+#if CONFIG_BLE_MESH_BQB_TEST
+#define SECURE_BEACON_INTERVAL     K_SECONDS(3)
+#else
 #define SECURE_BEACON_INTERVAL     K_SECONDS(10)
+#endif
 
 /* 3 transmissions, 20ms interval */
 #define UNPROV_XMIT                BLE_MESH_TRANSMIT(2, 20)
@@ -472,12 +478,13 @@ void bt_mesh_beacon_recv(struct net_buf_simple *buf, int8_t rssi)
             bt_mesh_provisioner_unprov_beacon_recv(buf, rssi);
         }
 
-        if (IS_ENABLED(CONFIG_BLE_MESH_RPR_SRV) &&
-            bt_mesh_is_provisioned()) {
+#if CONFIG_BLE_MESH_RPR_SRV
+        if (bt_mesh_is_provisioned()) {
             const bt_mesh_addr_t *addr = bt_mesh_get_unprov_dev_addr();
             bt_mesh_unprov_dev_fifo_enqueue(buf->data, addr->val, bt_mesh_get_adv_type());
             bt_mesh_rpr_srv_unprov_beacon_recv(buf, bt_mesh_get_adv_type(), addr, rssi);
         }
+#endif
         break;
     case BEACON_TYPE_SECURE:
         secure_beacon_recv(buf);

components/bt/esp_ble_mesh/core/bluedroid_host/adapter.c

@@ -32,7 +32,9 @@
 #include "net.h"
 #include "beacon.h"
 
+#if CONFIG_BLE_MESH_V11_SUPPORT
 #include "mesh_v1.1/utils.h"
+#endif
 
 struct bt_mesh_dev bt_mesh_dev;
 
@@ -1196,6 +1198,7 @@ uint16_t bt_mesh_gattc_get_service_uuid(struct bt_mesh_conn *conn)
 
 int bt_mesh_gattc_conn_create(const bt_mesh_addr_t *addr, uint16_t service_uuid)
 {
+    tBTA_BLE_CONN_PARAMS  conn_1m_param = {0};
     uint8_t zero[6] = {0};
     int i;
 
@@ -1249,10 +1252,14 @@ int bt_mesh_gattc_conn_create(const bt_mesh_addr_t *addr, uint16_t service_uuid)
      * Slave_latency: 0x0
      * Supervision_timeout: 1s
      */
-    BTA_DmSetBlePrefConnParams(bt_mesh_gattc_info[i].addr.val, 0x18, 0x18, 0x00, 0x64);
+    conn_1m_param.interval_min = 0x18;
+    conn_1m_param.interval_max = 0x18;
+    conn_1m_param.latency = 0;
+    conn_1m_param.supervision_timeout = 0x64;
 
-    BTA_GATTC_Open(bt_mesh_gattc_if, bt_mesh_gattc_info[i].addr.val,
-                   bt_mesh_gattc_info[i].addr.type, true, BTA_GATT_TRANSPORT_LE, FALSE);
+    BTA_GATTC_Enh_Open(bt_mesh_gattc_if, bt_mesh_gattc_info[i].addr.val,
+                   bt_mesh_gattc_info[i].addr.type, true, BTA_GATT_TRANSPORT_LE, FALSE, BLE_ADDR_UNKNOWN_TYPE,
+                   BTA_BLE_PHY_1M_MASK, &conn_1m_param, NULL, NULL);
 
     return 0;
 }

components/bt/esp_ble_mesh/core/cfg_srv.c

@@ -2,7 +2,7 @@
 
 /*
  * SPDX-FileCopyrightText: 2017 Intel Corporation
- * SPDX-FileContributor: 2018-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileContributor: 2018-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -30,7 +30,9 @@
 #include "mesh/common.h"
 #include "heartbeat.h"
 
+#if CONFIG_BLE_MESH_V11_SUPPORT
 #include "mesh_v1.1/utils.h"
+#endif
 
 #define DEFAULT_TTL         7
 
@@ -38,6 +40,158 @@ static struct bt_mesh_cfg_srv *conf;
 
 static struct label labels[CONFIG_BLE_MESH_LABEL_COUNT];
 
+#if !CONFIG_BLE_MESH_V11_SUPPORT
+const void *comp_0;
+
+static uint8_t bt_mesh_comp_page_check(uint8_t page, bool largest)
+{
+    /* If the page doesn't exist, TWO situations currently:
+     * 1. For Composition Data Get:
+     *    With the Page field set to the largest page number of
+     *    the Composition Data that the node supports and that is
+     *    less than the Page field value of the received Config
+     *    Composition Data Get message;
+     * 2. For Large Composition Data Get:
+     *    The Page field shall be set to the largest page number
+     *    of the Composition Data that the node supports.
+     */
+    ARG_UNUSED(largest);
+
+    if (page != 0) {
+        BT_WARN("Composition Data Page %d not exists", page);
+    }
+
+    return 0;
+}
+
+static inline uint16_t get_comp_elem_size(struct bt_mesh_elem *elem)
+{
+    return (4 + elem->model_count * 2 + elem->vnd_model_count * 4);
+}
+
+static uint16_t get_comp_data_size(const struct bt_mesh_comp *comp)
+{
+    uint16_t size = 10; /* CID + PID + VID + CRPL + Features */
+
+    for (int i = 0; i < comp->elem_count; i++) {
+        size += get_comp_elem_size(&(comp->elem[i]));
+    }
+
+    return size;
+}
+
+static void get_comp_data(struct net_buf_simple *buf,
+                          const struct bt_mesh_comp *comp,
+                          bool full_element)
+{
+    struct bt_mesh_model *model = NULL;
+    struct bt_mesh_elem *elem = NULL;
+    uint16_t feat = 0;
+
+    if (IS_ENABLED(CONFIG_BLE_MESH_RELAY)) {
+        feat |= BLE_MESH_FEAT_RELAY;
+    }
+
+    if (IS_ENABLED(CONFIG_BLE_MESH_GATT_PROXY_SERVER)) {
+        feat |= BLE_MESH_FEAT_PROXY;
+    }
+
+    if (IS_ENABLED(CONFIG_BLE_MESH_FRIEND)) {
+        feat |= BLE_MESH_FEAT_FRIEND;
+    }
+
+    if (IS_ENABLED(CONFIG_BLE_MESH_LOW_POWER)) {
+        feat |= BLE_MESH_FEAT_LOW_POWER;
+    }
+
+    net_buf_simple_add_le16(buf, comp->cid);
+    net_buf_simple_add_le16(buf, comp->pid);
+    net_buf_simple_add_le16(buf, comp->vid);
+    net_buf_simple_add_le16(buf, CONFIG_BLE_MESH_CRPL);
+    net_buf_simple_add_le16(buf, feat);
+
+    for (size_t i = 0; i < comp->elem_count; i++) {
+        elem = &(comp->elem[i]);
+
+        /* If "full_element" is true, which means the complete list
+         * of models within the element needs to fit in the data,
+         * otherwise the element shall not be reported.
+         */
+        if (full_element &&
+            net_buf_simple_tailroom(buf) < get_comp_elem_size(elem)) {
+            return;
+        }
+
+        net_buf_simple_add_le16(buf, elem->loc);
+        net_buf_simple_add_u8(buf, elem->model_count);
+        net_buf_simple_add_u8(buf, elem->vnd_model_count);
+
+        for (size_t j = 0; j < elem->model_count; j++) {
+            model = &(elem->models[j]);
+            net_buf_simple_add_le16(buf, model->id);
+        }
+
+        for (size_t j = 0; j < elem->vnd_model_count; j++) {
+            model = &(elem->vnd_models[j]);
+            net_buf_simple_add_le16(buf, model->vnd.company);
+            net_buf_simple_add_le16(buf, model->vnd.id);
+        }
+    }
+}
+
+static int fetch_comp_data(struct net_buf_simple *buf,
+                           const struct bt_mesh_comp *comp,
+                           uint8_t page, uint16_t offset,
+                           bool full_element)
+{
+    uint16_t size = get_comp_data_size(comp);
+
+    if (offset >= size) {
+        BT_WARN("Too large offset %d for comp data %d, size %d",
+                page, offset, size);
+        return 0;
+    }
+
+    if (net_buf_simple_tailroom(buf) < 10 ||
+        size - offset > net_buf_simple_tailroom(buf)) {
+        BT_ERR("Too small buffer for comp data %d, %d, expected %d",
+                page, buf->size, size - offset);
+        return -EINVAL;
+    }
+
+    if (offset) {
+        struct net_buf_simple *pdu = bt_mesh_alloc_buf(size);
+        if (pdu == NULL) {
+            BT_ERR("%s, Out of memory", __func__);
+            return -ENOMEM;
+        }
+
+        get_comp_data(pdu, comp, false);
+
+        /* Get part of Composition Data Page 0/128 */
+        net_buf_simple_add_mem(buf, pdu->data + offset, pdu->len - offset);
+
+        bt_mesh_free_buf(pdu);
+    } else {
+        get_comp_data(buf, comp, full_element);
+    }
+
+    return 0;
+}
+
+static int bt_mesh_get_comp_data(struct net_buf_simple *buf,
+                                 uint8_t page, uint16_t offset,
+                                 bool full_element)
+{
+    if (page == 0) {
+        return fetch_comp_data(buf, comp_0, page, offset, full_element);
+    }
+
+    BT_ERR("Invalid Composition Data Page %d", page);
+    return -EINVAL;
+}
+#endif /* !CONFIG_BLE_MESH_V11_SUPPORT */
+
 static void comp_data_get(struct bt_mesh_model *model,
                           struct bt_mesh_msg_ctx *ctx,
                           struct net_buf_simple *buf)
@@ -1133,7 +1287,7 @@ static struct label *va_find(const uint8_t *label_uuid,
     return match;
 }
 
-static uint8_t va_add(uint8_t *label_uuid, uint16_t *addr)
+uint8_t va_add(uint8_t *label_uuid, uint16_t *addr)
 {
     struct label *update = NULL, *free_slot = NULL;
 
@@ -1141,6 +1295,9 @@ static uint8_t va_add(uint8_t *label_uuid, uint16_t *addr)
     if (update) {
         update->ref++;
         va_store(update);
+        if (addr) {
+            *addr = update->addr;
+        }
         return STATUS_SUCCESS;
     }
 
@@ -1160,7 +1317,7 @@ static uint8_t va_add(uint8_t *label_uuid, uint16_t *addr)
     return STATUS_SUCCESS;
 }
 
-static uint8_t va_del(uint8_t *label_uuid, uint16_t *addr)
+uint8_t va_del(uint8_t *label_uuid, uint16_t *addr)
 {
     struct label *update = NULL;
 
@@ -2758,7 +2915,7 @@ static void node_reset(struct bt_mesh_model *model,
 
     bt_mesh_model_msg_init(&msg, OP_NODE_RESET_STATUS);
 
-    /* Send the response first since we wont have any keys left to
+    /* Send the response first since we won't have any keys left to
      * send it later.
      */
     if (bt_mesh_model_send(model, ctx, &msg, NULL, NULL)) {

components/bt/esp_ble_mesh/core/crypto.c

@@ -22,7 +22,9 @@
 #include "mesh/common.h"
 #include "mesh/adapter.h"
 
+#if CONFIG_BLE_MESH_V11_SUPPORT
 #include "mesh_v1.1/utils.h"
+#endif
 
 #define NET_MIC_LEN(pdu) (((pdu)[1] & 0x80) ? 8 : 4)
 #define APP_MIC_LEN(aszmic) ((aszmic) ? 8 : 4)

components/bt/esp_ble_mesh/core/friend.c

@@ -21,7 +21,9 @@
 #include "mesh/common.h"
 #include "pvnr_mgmt.h"
 
+#if CONFIG_BLE_MESH_V11_SUPPORT
 #include "mesh_v1.1/utils.h"
+#endif
 
 #ifdef CONFIG_BLE_MESH_FRIEND
 

components/bt/esp_ble_mesh/core/lpn.c

@@ -10,6 +10,7 @@
 #include <errno.h>
 
 #include "crypto.h"
+#include "tag.h"
 #include "adv.h"
 #include "scan.h"
 #include "mesh.h"
@@ -23,7 +24,9 @@
 #include "mesh/cfg_srv.h"
 #include "heartbeat.h"
 
+#if CONFIG_BLE_MESH_V11_SUPPORT
 #include "mesh_v1.1/utils.h"
+#endif
 
 #ifdef CONFIG_BLE_MESH_LOW_POWER
 

components/bt/esp_ble_mesh/core/main.c

@@ -2,7 +2,7 @@
 
 /*
  * SPDX-FileCopyrightText: 2017 Intel Corporation
- * SPDX-FileContributor: 2018-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileContributor: 2018-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -30,7 +30,9 @@
 #include "prov_pvnr.h"
 #include "pvnr_mgmt.h"
 
+#if CONFIG_BLE_MESH_V11_SUPPORT
 #include "mesh_v1.1/utils.h"
+#endif
 
 static bool mesh_init = false;
 
@@ -161,9 +163,9 @@ void bt_mesh_node_reset(void)
         bt_mesh_clear_seq();
         bt_mesh_clear_dkca();
         bt_mesh_clear_role();
-        if (IS_ENABLED(CONFIG_BLE_MESH_DF_SRV)) {
-            bt_mesh_clear_all_directed_forwarding_table_data();
-        }
+#if CONFIG_BLE_MESH_DF_SRV
+        bt_mesh_clear_all_directed_forwarding_table_data();
+#endif
     }
 
     memset(bt_mesh.flags, 0, sizeof(bt_mesh.flags));
@@ -405,12 +407,14 @@ int bt_mesh_init(const struct bt_mesh_prov *prov,
         return -EALREADY;
     }
 
+#if CONFIG_BLE_MESH_V11_SUPPORT
     extern int bt_mesh_v11_ext_init(void);
     err = bt_mesh_v11_ext_init();
     if (err) {
         BT_ERR("Bluetooth Mesh v1.1 init failed");
         return err;
     }
+#endif
 
     bt_mesh_mutex_init();
 

components/bt/esp_ble_mesh/core/mesh.h

@@ -11,6 +11,7 @@
 #define _MESH_H_
 
 #include "net.h"
+#include "tag.h"
 
 #ifdef __cplusplus
 extern "C" {

components/bt/esp_ble_mesh/core/net.c

@@ -31,7 +31,9 @@
 #include "proxy_server.h"
 #include "pvnr_mgmt.h"
 
+#if CONFIG_BLE_MESH_V11_SUPPORT
 #include "mesh_v1.1/utils.h"
+#endif
 
 /* Minimum valid Mesh Network PDU length. The Network headers
  * themselves take up 9 bytes. After that there is a minumum of 1 byte
@@ -1019,6 +1021,33 @@ int bt_mesh_net_encode(struct bt_mesh_net_tx *tx, struct net_buf_simple *buf,
     return bt_mesh_net_obfuscate(buf->data, BLE_MESH_NET_IVI_TX, priv);
 }
 
+#if !CONFIG_BLE_MESH_V11_SUPPORT
+static void bt_mesh_net_adv_xmit_update(struct bt_mesh_net_tx *tx)
+{
+    /* When transmitting a Network PDU that is tagged as friendship,
+     * the Advertising Bearer Network Interface shall transmit the
+     * Network PDU over the advertising bearer only once.
+     *
+     * Note: Currently when transmitting a packet with the friendship
+     * credentials used, the message flow will not reach here. It
+     * will be enqueued into the friend queue in transport.c, and
+     * waited to be sent.
+     */
+    if (bt_mesh_tag_friendship(tx->ctx->send_tag)) {
+        tx->xmit = BLE_MESH_TRANSMIT(0, BLE_MESH_TRANSMIT_INT(bt_mesh_net_transmit_get()));
+        return;
+    }
+
+    if (bt_mesh_tag_relay(tx->ctx->send_tag)) {
+        tx->xmit = bt_mesh_relay_retransmit_get();
+    } else {
+        tx->xmit = bt_mesh_net_transmit_get();
+    }
+
+    return;
+}
+#endif /* !CONFIG_BLE_MESH_V11_SUPPORT */
+
 int bt_mesh_net_send(struct bt_mesh_net_tx *tx, struct net_buf *buf,
                      const struct bt_mesh_send_cb *cb, void *cb_data)
 {
@@ -1418,13 +1447,94 @@ static bool relay_to_adv(enum bt_mesh_net_if net_if)
     case BLE_MESH_NET_IF_ADV:
         return (bt_mesh_relay_get() == BLE_MESH_RELAY_ENABLED);
     case BLE_MESH_NET_IF_PROXY:
-        return (bt_mesh_gatt_proxy_get() == BLE_MESH_GATT_PROXY_ENABLED ||
-                bt_mesh_private_gatt_proxy_state_get() == BLE_MESH_PRIVATE_GATT_PROXY_ENABLED);
+        return (bt_mesh_gatt_proxy_get() == BLE_MESH_GATT_PROXY_ENABLED
+#if CONFIG_BLE_MESH_PRB_SRV
+                || bt_mesh_private_gatt_proxy_state_get() == BLE_MESH_PRIVATE_GATT_PROXY_ENABLED
+#endif
+                );
     default:
         return false;
     }
 }
 
+#if !CONFIG_BLE_MESH_V11_SUPPORT
+static uint8_t net_retransmission_adv(struct bt_mesh_net_rx *rx,
+                                      uint8_t *cred, uint8_t *tag)
+{
+    if (rx->ctx.recv_cred == BLE_MESH_FLOODING_CRED) {
+        uint8_t bearer = BLE_MESH_NONE_BEARER;
+
+        /* Inbound bearer: ADV;
+         * Inbound Security Material: managed flooding;
+         */
+
+        /* Condition: Relay is enabled. */
+        if (IS_ENABLED(CONFIG_BLE_MESH_RELAY) &&
+            bt_mesh_relay_get() == BLE_MESH_RELAY_ENABLED) {
+            bearer |= BLE_MESH_ADV_BEARER;
+            *cred = BLE_MESH_FLOODING_CRED;
+            /* Additional action: Tag as relay */
+            *tag |= BLE_MESH_TAG_RELAY;
+        }
+
+        /* Condition: Proxy is enabled. */
+        if (IS_ENABLED(CONFIG_BLE_MESH_GATT_PROXY_SERVER) &&
+            bt_mesh_gatt_proxy_get() == BLE_MESH_GATT_PROXY_ENABLED) {
+            bearer |= BLE_MESH_GATT_BEARER;
+            *cred = BLE_MESH_FLOODING_CRED;
+        }
+
+        return bearer;
+    }
+
+    if (rx->ctx.recv_cred == BLE_MESH_FRIENDSHIP_CRED &&
+        IS_ENABLED(CONFIG_BLE_MESH_FRIEND) &&
+        bt_mesh_friend_get() == BLE_MESH_FRIEND_ENABLED) {
+
+        /* Condition: Directed friend is disabled. */
+        *cred = BLE_MESH_FLOODING_CRED;
+        return BLE_MESH_ALL_BEARERS;
+    }
+
+    return BLE_MESH_NONE_BEARER;
+}
+
+static uint8_t net_retransmission_gatt(struct bt_mesh_net_rx *rx,
+                                       uint8_t *cred, uint8_t *tag)
+{
+    if (rx->ctx.recv_cred == BLE_MESH_FLOODING_CRED) {
+        /* Inbound bearer: GATT;
+         * Inbound Security Material: managed flooding;
+         * Condition: Proxy is enabled;
+         */
+        if (IS_ENABLED(CONFIG_BLE_MESH_GATT_PROXY_SERVER) &&
+            bt_mesh_gatt_proxy_get() == BLE_MESH_GATT_PROXY_ENABLED) {
+            /* Condition: Directed proxy is disabled. */
+            *cred = BLE_MESH_FLOODING_CRED;
+            return BLE_MESH_ALL_BEARERS;
+        }
+
+        return BLE_MESH_NONE_BEARER;
+    }
+
+    return BLE_MESH_NONE_BEARER;
+}
+
+static uint8_t bt_mesh_net_retrans_match(struct bt_mesh_net_rx *rx,
+                                         uint8_t *cred, uint8_t *tag)
+{
+    if (rx->net_if == BLE_MESH_NET_IF_ADV) {
+        return net_retransmission_adv(rx, cred, tag);
+    }
+
+    if (rx->net_if == BLE_MESH_NET_IF_PROXY) {
+        return net_retransmission_gatt(rx, cred, tag);
+    }
+
+    return BLE_MESH_NONE_BEARER;
+}
+#endif /* !CONFIG_BLE_MESH_V11_SUPPORT */
+
 static void bt_mesh_net_relay(struct net_buf_simple *sbuf,
                               struct bt_mesh_net_rx *rx)
 {
@@ -1621,7 +1731,9 @@ static void bt_mesh_net_relay(struct net_buf_simple *sbuf,
         (bearer & BLE_MESH_GATT_BEARER) &&
         ((bt_mesh_gatt_proxy_get() == BLE_MESH_GATT_PROXY_ENABLED &&
           cred != BLE_MESH_FRIENDSHIP_CRED) ||
+#if CONFIG_BLE_MESH_PRB_SRV
          bt_mesh_private_gatt_proxy_state_get() == BLE_MESH_PRIVATE_GATT_PROXY_ENABLED ||
+#endif
          rx->net_if == BLE_MESH_NET_IF_LOCAL ||
          rx->ctx.recv_cred == BLE_MESH_FRIENDSHIP_CRED)) {
         if (bt_mesh_proxy_server_relay(&buf->b, rx->ctx.recv_dst) &&
@@ -1819,7 +1931,9 @@ void bt_mesh_net_recv(struct net_buf_simple *data, int8_t rssi,
                       bt_mesh_elem_find(rx.ctx.recv_dst));
 
     if (IS_ENABLED(CONFIG_BLE_MESH_GATT_PROXY_SERVER) &&
+#if CONFIG_BLE_MESH_PRB_SRV
         bt_mesh_private_gatt_proxy_state_get() != BLE_MESH_PRIVATE_GATT_PROXY_ENABLED &&
+#endif
         net_if == BLE_MESH_NET_IF_PROXY) {
         bt_mesh_proxy_server_addr_add(data, rx.ctx.addr);
 

components/bt/esp_ble_mesh/core/prov_common.c

@@ -143,7 +143,7 @@ bool bt_mesh_prov_pdu_check(uint8_t type, uint16_t length, uint8_t *reason)
 
 static uint8_t bt_mesh_prov_buf_type_get(struct net_buf_simple *buf)
 {
-    return buf->data[PROV_BUF_HEADROOM];
+    return buf->__buf[PROV_BUF_HEADROOM];
 }
 
 uint8_t node_next_xact_id(struct bt_mesh_prov_link *link)

components/bt/esp_ble_mesh/core/prov_common.h

@@ -17,7 +17,9 @@
 #include "mesh/timer.h"
 #include "mesh/adapter.h"
 
+#if CONFIG_BLE_MESH_V11_SUPPORT
 #include "mesh_v1.1/utils.h"
+#endif
 
 #ifdef __cplusplus
 extern "C" {

components/bt/esp_ble_mesh/core/prov_node.c

@@ -22,7 +22,9 @@
 #include "prov_common.h"
 #include "prov_node.h"
 
+#if CONFIG_BLE_MESH_V11_SUPPORT
 #include "mesh_v1.1/utils.h"
+#endif
 
 #if CONFIG_BLE_MESH_NODE
 

components/bt/esp_ble_mesh/core/prov_pvnr.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2017-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2017-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -22,7 +22,9 @@
 #include "prov_pvnr.h"
 #include "pvnr_mgmt.h"
 
+#if CONFIG_BLE_MESH_V11_SUPPORT
 #include "mesh_v1.1/utils.h"
+#endif
 
 #if CONFIG_BLE_MESH_PROVISIONER
 
@@ -1413,7 +1415,7 @@ static int prov_auth(struct bt_mesh_prov_link *link,
             return -EINVAL;
         }
 
-        /* Provisioner ouput number/string and wait for device's Provisioning Input Complete PDU */
+        /* Provisioner output number/string and wait for device's Provisioning Input Complete PDU */
         link->expect = PROV_INPUT_COMPLETE;
 
         /* NOTE: The Bluetooth SIG recommends that mesh implementations enforce a randomly

components/bt/esp_ble_mesh/core/proxy_client.c

@@ -21,7 +21,9 @@
 #include "pvnr_mgmt.h"
 #include "mesh/adapter.h"
 
+#if CONFIG_BLE_MESH_V11_SUPPORT
 #include "mesh_v1.1/utils.h"
+#endif
 
 #if (CONFIG_BLE_MESH_PROVISIONER && CONFIG_BLE_MESH_PB_GATT) || \
      CONFIG_BLE_MESH_GATT_PROXY_CLIENT

components/bt/esp_ble_mesh/core/proxy_client.h

@@ -11,7 +11,9 @@
 #include "mesh/adapter.h"
 #include "prov_common.h"
 
+#if CONFIG_BLE_MESH_V11_SUPPORT
 #include "mesh_v1.1/utils.h"
+#endif
 
 #ifdef __cplusplus
 extern "C" {

components/bt/esp_ble_mesh/core/proxy_server.c

@@ -22,7 +22,9 @@
 #include "prov_common.h"
 #include "prov_node.h"
 
+#if CONFIG_BLE_MESH_V11_SUPPORT
 #include "mesh_v1.1/utils.h"
+#endif
 
 #if (CONFIG_BLE_MESH_NODE && CONFIG_BLE_MESH_PB_GATT) || \
      CONFIG_BLE_MESH_GATT_PROXY_SERVER

components/bt/esp_ble_mesh/core/pvnr_mgmt.c

@@ -22,7 +22,9 @@
 #include "prov_pvnr.h"
 #include "pvnr_mgmt.h"
 
+#if CONFIG_BLE_MESH_V11_SUPPORT
 #include "mesh_v1.1/utils.h"
+#endif
 
 #if CONFIG_BLE_MESH_PROVISIONER
 

components/bt/esp_ble_mesh/core/scan.c

@@ -2,7 +2,7 @@
 
 /*
  * SPDX-FileCopyrightText: 2017 Intel Corporation
- * SPDX-FileContributor: 2020-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileContributor: 2020-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -27,7 +27,9 @@
 #include "prov_pvnr.h"
 #include "mesh/adapter.h"
 
+#if CONFIG_BLE_MESH_V11_SUPPORT
 #include "mesh_v1.1/utils.h"
+#endif
 
 /* Scan Window and Interval are equal for continuous scanning */
 #define SCAN_INTERVAL   0x20
@@ -263,12 +265,13 @@ static void handle_adv_service_data(struct net_buf_simple *buf,
             bt_mesh_provisioner_prov_adv_recv(buf, addr, rssi);
         }
 
-        if (IS_ENABLED(CONFIG_BLE_MESH_RPR_SRV) &&
-            bt_mesh_is_provisioned()) {
+#if CONFIG_BLE_MESH_RPR_SRV
+        if (bt_mesh_is_provisioned()) {
             const bt_mesh_addr_t *addr = bt_mesh_get_unprov_dev_addr();
             bt_mesh_unprov_dev_fifo_enqueue(buf->data, addr->val, bt_mesh_get_adv_type());
             bt_mesh_rpr_srv_unprov_beacon_recv(buf, bt_mesh_get_adv_type(), addr, rssi);
         }
+#endif
         break;
 #endif
 #if CONFIG_BLE_MESH_GATT_PROXY_CLIENT

components/bt/esp_ble_mesh/core/storage/settings.c

@@ -22,7 +22,9 @@
 #include "pvnr_mgmt.h"
 #include "prov_pvnr.h"
 
+#if CONFIG_BLE_MESH_V11_SUPPORT
 #include "mesh_v1.1/utils.h"
+#endif
 
 /* BLE Mesh NVS Key and corresponding data struct.
  * Note: The length of nvs key must be <= 15.
@@ -1481,6 +1483,8 @@ int settings_core_commit(void)
         struct bt_mesh_hb_pub *hb_pub = NULL;
         struct bt_mesh_cfg_srv *cfg = NULL;
 
+        bt_mesh_atomic_set_bit(bt_mesh.flags, BLE_MESH_VALID);
+
         hb_pub = bt_mesh_hb_pub_get();
         if (hb_pub && hb_pub->dst != BLE_MESH_ADDR_UNASSIGNED &&
             hb_pub->count && hb_pub->period) {
@@ -1499,7 +1503,6 @@ int settings_core_commit(void)
             cfg->default_ttl = stored_cfg.cfg.default_ttl;
         }
 
-        bt_mesh_atomic_set_bit(bt_mesh.flags, BLE_MESH_VALID);
         bt_mesh_net_start();
     }
 #endif /* CONFIG_BLE_MESH_NODE */

components/bt/esp_ble_mesh/core/tag.h

@@ -0,0 +1,53 @@
+/*
+ * SPDX-FileCopyrightText: 2020-2024 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#ifndef _BLE_MESH_v11_TAG_H_
+#define _BLE_MESH_v11_TAG_H_
+
+#include <stdint.h>
+#include <stdbool.h>
+
+#include "mesh.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#if !CONFIG_BLE_MESH_V11_SUPPORT
+
+/* TAG - additional metadata */
+#define BLE_MESH_TAG_SEND_SEGMENTED     BIT(0)
+#define BLE_MESH_TAG_IMMUTABLE_CRED     BIT(1)
+#define BLE_MESH_TAG_RELAY              BIT(3)
+#define BLE_MESH_TAG_FRIENDSHIP         BIT(4)
+
+static inline bool bt_mesh_tag_send_segmented(uint8_t tag)
+{
+    return (tag & BLE_MESH_TAG_SEND_SEGMENTED);
+}
+
+static inline bool bt_mesh_tag_immutable_cred(uint8_t tag)
+{
+    return (tag & BLE_MESH_TAG_IMMUTABLE_CRED);
+}
+
+static inline bool bt_mesh_tag_relay(uint8_t tag)
+{
+    return (tag & BLE_MESH_TAG_RELAY);
+}
+
+static inline bool bt_mesh_tag_friendship(uint8_t tag)
+{
+    return (tag & BLE_MESH_TAG_FRIENDSHIP);
+}
+
+#endif /* !CONFIG_BLE_MESH_V11_SUPPORT */
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _BLE_MESH_v11_TAG_H_ */

components/bt/esp_ble_mesh/core/transport.c

@@ -11,6 +11,7 @@
 #include <errno.h>
 
 #include "crypto.h"
+#include "tag.h"
 #include "adv.h"
 #include "mesh.h"
 #include "lpn.h"
@@ -26,7 +27,9 @@
 #include "mesh/cfg_srv.h"
 #include "heartbeat.h"
 
+#if CONFIG_BLE_MESH_V11_SUPPORT
 #include "mesh_v1.1/utils.h"
+#endif
 
 /* The transport layer needs at least three buffers for itself to avoid
  * deadlocks. Ensure that there are a sufficient number of advertising
@@ -1039,18 +1042,18 @@ static int ctl_recv(struct bt_mesh_net_rx *rx, uint8_t hdr,
         return 0;
     }
 
-    if (IS_ENABLED(CONFIG_BLE_MESH_DF_SRV)) {
-        switch (ctl_op) {
-        case TRANS_CTL_OP_PATH_REQ:
-        case TRANS_CTL_OP_PATH_REPLY:
-        case TRANS_CTL_OP_PATH_CFM:
-        case TRANS_CTL_OP_PATH_ECHO_REQ:
-        case TRANS_CTL_OP_PATH_ECHO_REPLY:
-        case TRANS_CTL_OP_DEP_NODE_UPDATE:
-        case TRANS_CTL_OP_PATH_REQ_SOLIC:
-            return bt_mesh_directed_forwarding_ctl_recv(ctl_op, rx, buf);
-        }
+#if CONFIG_BLE_MESH_DF_SRV
+    switch (ctl_op) {
+    case TRANS_CTL_OP_PATH_REQ:
+    case TRANS_CTL_OP_PATH_REPLY:
+    case TRANS_CTL_OP_PATH_CFM:
+    case TRANS_CTL_OP_PATH_ECHO_REQ:
+    case TRANS_CTL_OP_PATH_ECHO_REPLY:
+    case TRANS_CTL_OP_DEP_NODE_UPDATE:
+    case TRANS_CTL_OP_PATH_REQ_SOLIC:
+        return bt_mesh_directed_forwarding_ctl_recv(ctl_op, rx, buf);
     }
+#endif
 
     if (IS_ENABLED(CONFIG_BLE_MESH_FRIEND) && !bt_mesh_lpn_established()) {
         switch (ctl_op) {
@@ -1759,8 +1762,6 @@ void bt_mesh_trans_init(void)
 {
     int i;
 
-    bt_mesh_sar_init();
-
     for (i = 0; i < ARRAY_SIZE(seg_tx); i++) {
         k_delayed_work_init(&seg_tx[i].rtx_timer, seg_retransmit);
     }

components/bt/esp_ble_mesh/lib/ext.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2023-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -8,6 +8,8 @@
 #include <string.h>
 #include <assert.h>
 
+#include "esp_log.h"
+
 #if CONFIG_BT_BLUEDROID_ENABLED
 #include "bta/bta_api.h"
 #endif
@@ -190,6 +192,11 @@ void bt_mesh_ext_mem_swap(void *buf, size_t length)
     sys_mem_swap(buf, length);
 }
 
+uint32_t bt_mesh_ext_log_timestamp(void)
+{
+    return esp_log_timestamp();
+}
+
 /* Net buf */
 void bt_mesh_ext_buf_simple_init(struct net_buf_simple *buf, size_t reserve_head)
 {
@@ -498,6 +505,11 @@ float bt_mesh_ext_log2(float num)
     return bt_mesh_log2(num);
 }
 
+const char *bt_mesh_ext_hex(const void *buf, size_t len)
+{
+    return bt_hex(buf, len);
+}
+
 /* Crypto */
 bool bt_mesh_ext_s1(const char *m, uint8_t salt[16])
 {
@@ -3954,6 +3966,8 @@ void bt_mesh_ext_mbt_server_cb_evt_to_btc(uint8_t event, void *model, void *ctx)
 }
 
 typedef struct {
+    uint64_t config_ble_mesh_stack_trace_level : 3;
+
     uint64_t config_ble_mesh_use_duplicate_scan : 1;
     uint64_t config_ble_mesh_pb_adv : 1;
     uint64_t config_ble_mesh_pb_gatt : 1;
@@ -4116,6 +4130,8 @@ typedef struct {
 } bt_mesh_ext_config_t;
 
 static const bt_mesh_ext_config_t bt_mesh_ext_cfg = {
+    .config_ble_mesh_stack_trace_level              = BLE_MESH_LOG_LEVEL,
+
     .config_ble_mesh_use_duplicate_scan             = IS_ENABLED(CONFIG_BLE_MESH_USE_DUPLICATE_SCAN),
     .config_ble_mesh_pb_adv                         = IS_ENABLED(CONFIG_BLE_MESH_PB_ADV),
     .config_ble_mesh_pb_gatt                        = IS_ENABLED(CONFIG_BLE_MESH_PB_GATT),

components/bt/esp_ble_mesh/lib/include/mesh_v1.1/utils.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2023-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */

components/bt/esp_ble_mesh/models/client/client_common.c

@@ -14,7 +14,9 @@
 #include "mesh/client_common.h"
 #include "mesh/common.h"
 
+#if CONFIG_BLE_MESH_V11_SUPPORT
 #include "mesh_v1.1/utils.h"
+#endif
 
 #define HCI_TIME_FOR_START_ADV  K_MSEC(5)   /* Three adv related hci commands may take 4 ~ 5ms */
 

components/bt/host/bluedroid/Kconfig.in

@@ -66,7 +66,7 @@ config BT_A2DP_ENABLE
     depends on BT_CLASSIC_ENABLED
     default n
     help
-        Advanced Audio Distrubution Profile
+        Advanced Audio Distribution Profile
 
 config BT_SPP_ENABLED
     bool "SPP"
@@ -121,7 +121,7 @@ config BT_HFP_WBS_ENABLE
     default y
     help
         This enables Wide Band Speech. Should disable it when SCO data path is PCM.
-        Otherwise there will be no data transmited via GPIOs.
+        Otherwise there will be no data transmitted via GPIOs.
 
 
 menuconfig BT_HID_ENABLED
@@ -304,6 +304,13 @@ config BT_BLE_SMP_ID_RESET_ENABLE
         of a previously paired peer to be used to determine whether a device
         with which it previously shared an IRK is within range.
 
+config BT_BLE_SMP_BOND_NVS_FLASH
+    bool "Save SMP bonding keys to nvs flash"
+    depends on BT_BLE_SMP_ENABLE
+    default y
+    help
+        This select can save SMP bonding keys to nvs flash
+
 config BT_STACK_NO_LOG
     bool "Disable BT debug logs (minimize bin size)"
     depends on BT_BLUEDROID_ENABLED
@@ -1064,7 +1071,7 @@ config BT_ACL_CONNECTIONS
         is used.
 
 config BT_MULTI_CONNECTION_ENBALE
-    bool "Enable BLE multi-conections"
+    bool "Enable BLE multi-connections"
     depends on BT_BLE_ENABLED
     default y
     help
@@ -1163,19 +1170,23 @@ config BT_BLE_RPA_TIMEOUT
         Default is 900 s (15 minutes). Range is 1 s to 1 hour (3600 s).
 
 config BT_BLE_50_FEATURES_SUPPORTED
-    bool "Enable BLE 5.0 features"
+    bool "Enable BLE 5.0 features(please disable BLE 4.2 if enable BLE 5.0)"
     depends on (BT_BLE_ENABLED && ((BT_CONTROLLER_ENABLED && SOC_BLE_50_SUPPORTED) || BT_CONTROLLER_DISABLED))
     default y
     help
         Enabling this option activates BLE 5.0 features.
         This option is universally supported in chips that support BLE, except for ESP32.
+        BLE 4.2 and BLE 5.0 cannot be used simultaneously.
+
 
 config BT_BLE_42_FEATURES_SUPPORTED
-    bool "Enable BLE 4.2 features"
-    depends on (BT_BLE_ENABLED && ((BT_CONTROLLER_ENABLED && SOC_BLE_SUPPORTED) || BT_CONTROLLER_DISABLED))
+    bool "Enable BLE 4.2 features(please disable BLE 5.0 if enable BLE 4.2)"
+    depends on (BT_BLE_ENABLED && ((BT_CONTROLLER_ENABLED && SOC_BLE_50_SUPPORTED) || BT_CONTROLLER_DISABLED))
     default n
     help
         This enables BLE 4.2 features.
+        This option is universally supported by all ESP chips with BLE capabilities.
+        BLE 4.2 and BLE 5.0 cannot be used simultaneously.
 
 config BT_BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER
     bool "Enable BLE periodic advertising sync transfer feature"

components/bt/host/bluedroid/api/esp_bt_main.c

@@ -238,3 +238,14 @@ esp_err_t esp_bluedroid_deinit(void)
 
     return ESP_OK;
 }
+
+#if defined(CONFIG_EXAMPLE_CI_ID) && defined(CONFIG_EXAMPLE_CI_PIPELINE_ID)
+char *esp_bluedroid_get_example_name(void)
+{
+    static char example_name[ESP_BLE_ADV_NAME_LEN_MAX];
+    memset(example_name, 0, sizeof(example_name));
+    sprintf(example_name, "BE%02X_%05X_%02X", CONFIG_EXAMPLE_CI_ID & 0xFF,
+            CONFIG_EXAMPLE_CI_PIPELINE_ID & 0xFFFFF, CONFIG_IDF_FIRMWARE_CHIP_ID & 0xFF);
+    return example_name;
+}
+#endif

components/bt/host/bluedroid/api/esp_gap_ble_api.c

@@ -13,7 +13,7 @@
 #include "btc/btc_manage.h"
 #include "btc_gap_ble.h"
 #include "btc/btc_ble_storage.h"
-
+#include "esp_random.h"
 
 esp_err_t esp_ble_gap_register_callback(esp_gap_ble_cb_t callback)
 {
@@ -188,6 +188,25 @@ esp_err_t esp_ble_gap_set_pkt_data_len(esp_bd_addr_t remote_device, uint16_t tx_
     return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
+esp_err_t esp_ble_gap_addr_create_static(esp_bd_addr_t rand_addr)
+{
+    // Static device address: First two bits are '11', rest is random
+    rand_addr[0] = 0xC0 | (esp_random() & 0x3F);
+    for (int i = 1; i < 6; i++) {
+        rand_addr[i] = esp_random() & 0xFF; // Randomize remaining bits
+    }
+    return ESP_OK;
+}
+
+esp_err_t esp_ble_gap_addr_create_nrpa(esp_bd_addr_t rand_addr)
+{
+    // Non-resolvable private address: First two bits are '00', rest is random
+    rand_addr[0] = (esp_random() & 0x3F);
+    for (int i = 1; i < 6; i++) {
+        rand_addr[i] = esp_random() & 0xFF; // Randomize remaining bits
+    }
+    return ESP_OK;
+}
 
 esp_err_t esp_ble_gap_set_rand_addr(esp_bd_addr_t rand_addr)
 {
@@ -493,13 +512,17 @@ uint8_t *esp_ble_resolve_adv_data_by_type( uint8_t *adv_data, uint16_t adv_data_
 
     if (((type < ESP_BLE_AD_TYPE_FLAG) || (type > ESP_BLE_AD_TYPE_128SERVICE_DATA)) &&
             (type != ESP_BLE_AD_MANUFACTURER_SPECIFIC_TYPE)) {
-        LOG_ERROR("the eir type not define, type = %x\n", type);
+        LOG_ERROR("The advertising data type is not defined, type = %x", type);
         *length = 0;
         return NULL;
     }
 
-    if (adv_data == NULL || adv_data_len == 0) {
-        LOG_ERROR("Invalid advertising data.\n");
+    if (adv_data_len == 0) {
+        *length = 0;
+        return NULL;
+    }
+    if (adv_data == NULL) {
+        LOG_ERROR("Invalid advertising data.");
         *length = 0;
         return NULL;
     }
@@ -1026,6 +1049,23 @@ esp_err_t esp_ble_gap_set_privacy_mode(esp_ble_addr_type_t addr_type, esp_bd_add
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
+esp_err_t esp_ble_gap_set_csa_support(uint8_t csa_select)
+{
+    btc_msg_t msg;
+    btc_ble_gap_args_t arg;
+
+    ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_GAP_BLE;
+    msg.act = BTC_GAP_BLE_SET_CSA_SUPPORT;
+
+    arg.set_csa_support.csa_select = csa_select;
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), NULL, NULL)
+            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
 #if (BLE_50_FEATURE_SUPPORT == TRUE)
 
 esp_err_t esp_ble_gap_read_phy(esp_bd_addr_t bd_addr)

components/bt/host/bluedroid/api/esp_gattc_api.c

@@ -67,46 +67,134 @@ esp_err_t esp_ble_gattc_app_unregister(esp_gatt_if_t gattc_if)
 
     return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gattc_args_t), NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
-#if (BLE_42_FEATURE_SUPPORT == TRUE)
-esp_err_t esp_ble_gattc_open(esp_gatt_if_t gattc_if, esp_bd_addr_t remote_bda, esp_ble_addr_type_t remote_addr_type, bool is_direct)
+
+esp_err_t esp_ble_gattc_enh_open(esp_gatt_if_t gattc_if, esp_ble_gatt_creat_conn_params_t *creat_conn_params)
 {
     btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
+    const esp_ble_conn_params_t *conn_params;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
+    if (!creat_conn_params) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_GATTC;
     msg.act = BTC_GATTC_ACT_OPEN;
     arg.open.gattc_if = gattc_if;
-    memcpy(arg.open.remote_bda, remote_bda, ESP_BD_ADDR_LEN);
-    arg.open.remote_addr_type = remote_addr_type;
-    arg.open.is_direct = is_direct;
-    arg.open.is_aux = false;
+    memcpy(arg.open.remote_bda, creat_conn_params->remote_bda, ESP_BD_ADDR_LEN);
+    arg.open.remote_addr_type = creat_conn_params->remote_addr_type;
+    arg.open.is_direct = creat_conn_params->is_direct;
+    arg.open.is_aux= creat_conn_params->is_aux;
+    arg.open.own_addr_type = creat_conn_params->own_addr_type;
+    arg.open.phy_mask = creat_conn_params->phy_mask;
+
+    // If not aux open, shouldn't set 2M and coded PHY connection params
+    if (!creat_conn_params->is_aux &&
+        ((creat_conn_params->phy_mask & ESP_BLE_PHY_2M_PREF_MASK) ||
+        (creat_conn_params->phy_mask & ESP_BLE_PHY_CODED_PREF_MASK))) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    if (creat_conn_params->phy_mask & ESP_BLE_PHY_1M_PREF_MASK) {
+        if (!creat_conn_params->phy_1m_conn_params) {
+            return ESP_ERR_INVALID_ARG;
+        }
+
+        conn_params = creat_conn_params->phy_1m_conn_params;
+        if (ESP_BLE_IS_VALID_PARAM(conn_params->interval_min, ESP_BLE_CONN_INT_MIN, ESP_BLE_CONN_INT_MAX) &&
+            ESP_BLE_IS_VALID_PARAM(conn_params->interval_max, ESP_BLE_CONN_INT_MIN, ESP_BLE_CONN_INT_MAX) &&
+            ESP_BLE_IS_VALID_PARAM(conn_params->supervision_timeout, ESP_BLE_CONN_SUP_TOUT_MIN, ESP_BLE_CONN_SUP_TOUT_MAX) &&
+            (conn_params->latency <= ESP_BLE_CONN_LATENCY_MAX) &&
+            ((conn_params->supervision_timeout * 10) >= ((1 + conn_params->latency) * ((conn_params->interval_max * 5) >> 1))) &&
+            (conn_params->interval_min <= conn_params->interval_max)) {
+            memcpy(&arg.open.phy_1m_conn_params, conn_params, sizeof(esp_ble_conn_params_t));
+        } else {
+            LOG_ERROR("%s, invalid 1M PHY connection params: min_int = %d, max_int = %d, latency = %d, timeout = %d", __func__,
+                                    conn_params->interval_min,
+                                    conn_params->interval_max,
+                                    conn_params->latency,
+                                    conn_params->supervision_timeout);
+            return ESP_ERR_INVALID_ARG;
+        }
+    }
+
+    if (creat_conn_params->phy_mask & ESP_BLE_PHY_2M_PREF_MASK) {
+        if (!creat_conn_params->phy_2m_conn_params) {
+            return ESP_ERR_INVALID_ARG;
+        }
+
+        conn_params = creat_conn_params->phy_2m_conn_params;
+        if (ESP_BLE_IS_VALID_PARAM(conn_params->interval_min, ESP_BLE_CONN_INT_MIN, ESP_BLE_CONN_INT_MAX) &&
+            ESP_BLE_IS_VALID_PARAM(conn_params->interval_max, ESP_BLE_CONN_INT_MIN, ESP_BLE_CONN_INT_MAX) &&
+            ESP_BLE_IS_VALID_PARAM(conn_params->supervision_timeout, ESP_BLE_CONN_SUP_TOUT_MIN, ESP_BLE_CONN_SUP_TOUT_MAX) &&
+            (conn_params->latency <= ESP_BLE_CONN_LATENCY_MAX) &&
+            ((conn_params->supervision_timeout * 10) >= ((1 + conn_params->latency) * ((conn_params->interval_max * 5) >> 1))) &&
+            (conn_params->interval_min <= conn_params->interval_max)) {
+            memcpy(&arg.open.phy_2m_conn_params, conn_params, sizeof(esp_ble_conn_params_t));
+        } else {
+            LOG_ERROR("%s, invalid 2M PHY connection params: min_int = %d, max_int = %d, latency = %d, timeout = %d", __func__,
+                                    conn_params->interval_min,
+                                    conn_params->interval_max,
+                                    conn_params->latency,
+                                    conn_params->supervision_timeout);
+            return ESP_ERR_INVALID_ARG;
+        }
+    }
+
+    if (creat_conn_params->phy_mask & ESP_BLE_PHY_CODED_PREF_MASK) {
+        if (!creat_conn_params->phy_coded_conn_params) {
+            return ESP_ERR_INVALID_ARG;
+        }
+
+        conn_params = creat_conn_params->phy_coded_conn_params;
+        if (ESP_BLE_IS_VALID_PARAM(conn_params->interval_min, ESP_BLE_CONN_INT_MIN, ESP_BLE_CONN_INT_MAX) &&
+            ESP_BLE_IS_VALID_PARAM(conn_params->interval_max, ESP_BLE_CONN_INT_MIN, ESP_BLE_CONN_INT_MAX) &&
+            ESP_BLE_IS_VALID_PARAM(conn_params->supervision_timeout, ESP_BLE_CONN_SUP_TOUT_MIN, ESP_BLE_CONN_SUP_TOUT_MAX) &&
+            (conn_params->latency <= ESP_BLE_CONN_LATENCY_MAX) &&
+            ((conn_params->supervision_timeout * 10) >= ((1 + conn_params->latency) * ((conn_params->interval_max * 5) >> 1))) &&
+            (conn_params->interval_min <= conn_params->interval_max)) {
+            memcpy(&arg.open.phy_coded_conn_params, conn_params, sizeof(esp_ble_conn_params_t));
+        } else {
+            LOG_ERROR("%s, invalid Coded PHY connection params: min_int = %d, max_int = %d, latency = %d, timeout = %d", __func__,
+                                    conn_params->interval_min,
+                                    conn_params->interval_max,
+                                    conn_params->latency,
+                                    conn_params->supervision_timeout);
+            return ESP_ERR_INVALID_ARG;
+        }
+    }
 
     return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gattc_args_t), NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
+
+#if (BLE_42_FEATURE_SUPPORT == TRUE)
+esp_err_t esp_ble_gattc_open(esp_gatt_if_t gattc_if, esp_bd_addr_t remote_bda, esp_ble_addr_type_t remote_addr_type, bool is_direct)
+{
+    esp_ble_gatt_creat_conn_params_t creat_conn_params = {0};
+    memcpy(creat_conn_params.remote_bda, remote_bda, ESP_BD_ADDR_LEN);
+    creat_conn_params.remote_addr_type = remote_addr_type;
+    creat_conn_params.is_direct = is_direct;
+    creat_conn_params.is_aux = false;
+    creat_conn_params.own_addr_type = 0xff; //undefined, will use local value
+    creat_conn_params.phy_mask = 0x0;
+    return esp_ble_gattc_enh_open(gattc_if, &creat_conn_params);
+}
 #endif // #if (BLE_42_FEATURE_SUPPORT == TRUE)
 
 #if (BLE_50_FEATURE_SUPPORT == TRUE)
 esp_err_t esp_ble_gattc_aux_open(esp_gatt_if_t gattc_if, esp_bd_addr_t remote_bda, esp_ble_addr_type_t remote_addr_type, bool is_direct)
 {
-    btc_msg_t msg;
-    btc_ble_gattc_args_t arg;
-
-    ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
-
-    msg.sig = BTC_SIG_API_CALL;
-    msg.pid = BTC_PID_GATTC;
-    msg.act = BTC_GATTC_ACT_AUX_OPEN;
-    arg.open.gattc_if = gattc_if;
-    memcpy(arg.open.remote_bda, remote_bda, ESP_BD_ADDR_LEN);
-    arg.open.remote_addr_type = remote_addr_type;
-    arg.open.is_direct = is_direct;
-    arg.open.is_aux = true;
-
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gattc_args_t), NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
-
+    esp_ble_gatt_creat_conn_params_t creat_conn_params = {0};
+    memcpy(creat_conn_params.remote_bda, remote_bda, ESP_BD_ADDR_LEN);
+    creat_conn_params.remote_addr_type = remote_addr_type;
+    creat_conn_params.is_direct = is_direct;
+    creat_conn_params.is_aux = true;
+    creat_conn_params.own_addr_type = 0xff; //undefined, will use local value
+    creat_conn_params.phy_mask = 0x0;
+    return esp_ble_gattc_enh_open(gattc_if, &creat_conn_params);
 }
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
 
@@ -363,10 +451,14 @@ esp_err_t esp_ble_gattc_read_char (esp_gatt_if_t gattc_if,
     }
 
     if (L2CA_CheckIsCongest(L2CAP_ATT_CID, p_tcb->peer_bda)) {
-        LOG_DEBUG("%s, the l2cap chanel is congest.", __func__);
+        LOG_DEBUG("%s, the l2cap channel is congest.", __func__);
         return ESP_FAIL;
     }
 
+    if (handle == 0) {
+        return ESP_GATT_INVALID_HANDLE;
+    }
+
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_GATTC;
     msg.act = BTC_GATTC_ACT_READ_CHAR;
@@ -400,10 +492,14 @@ esp_err_t esp_ble_gattc_read_by_type (esp_gatt_if_t gattc_if,
     }
 
     if (L2CA_CheckIsCongest(L2CAP_ATT_CID, p_tcb->peer_bda)) {
-        LOG_DEBUG("%s, the l2cap chanel is congest.", __func__);
+        LOG_DEBUG("%s, the l2cap channel is congest.", __func__);
         return ESP_FAIL;
     }
 
+    if (start_handle == 0 || end_handle == 0) {
+        return ESP_GATT_INVALID_HANDLE;
+    }
+
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_GATTC;
     msg.act = BTC_GATTC_ACT_READ_BY_TYPE;
@@ -432,7 +528,7 @@ esp_err_t esp_ble_gattc_read_multiple(esp_gatt_if_t gattc_if,
     }
 
     if (L2CA_CheckIsCongest(L2CAP_ATT_CID, p_tcb->peer_bda)) {
-        LOG_DEBUG("%s, the l2cap chanel is congest.", __func__);
+        LOG_DEBUG("%s, the l2cap channel is congest.", __func__);
         return ESP_FAIL;
     }
 
@@ -468,7 +564,7 @@ esp_err_t esp_ble_gattc_read_multiple_variable(esp_gatt_if_t gattc_if,
     }
 
     if (L2CA_CheckIsCongest(L2CAP_ATT_CID, p_tcb->peer_bda)) {
-        LOG_DEBUG("%s, the l2cap chanel is congest.", __func__);
+        LOG_DEBUG("%s, the l2cap channel is congest.", __func__);
         return ESP_FAIL;
     }
 
@@ -504,10 +600,14 @@ esp_err_t esp_ble_gattc_read_char_descr (esp_gatt_if_t gattc_if,
     }
 
     if (L2CA_CheckIsCongest(L2CAP_ATT_CID, p_tcb->peer_bda)) {
-        LOG_DEBUG("%s, the l2cap chanel is congest.", __func__);
+        LOG_DEBUG("%s, the l2cap channel is congest.", __func__);
         return ESP_FAIL;
     }
 
+    if (handle == 0) {
+        return ESP_GATT_INVALID_HANDLE;
+    }
+
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_GATTC;
     msg.act = BTC_GATTC_ACT_READ_CHAR_DESCR;
@@ -537,10 +637,14 @@ esp_err_t esp_ble_gattc_write_char(esp_gatt_if_t gattc_if,
     }
 
     if (L2CA_CheckIsCongest(L2CAP_ATT_CID, p_tcb->peer_bda)) {
-        LOG_DEBUG("%s, the l2cap chanel is congest.", __func__);
+        LOG_DEBUG("%s, the l2cap channel is congest.", __func__);
         return ESP_FAIL;
     }
 
+    if (handle == 0) {
+        return ESP_GATT_INVALID_HANDLE;
+    }
+
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_GATTC;
     msg.act = BTC_GATTC_ACT_WRITE_CHAR;
@@ -576,10 +680,14 @@ esp_err_t esp_ble_gattc_write_char_descr (esp_gatt_if_t gattc_if,
     }
 
     if (L2CA_CheckIsCongest(L2CAP_ATT_CID, p_tcb->peer_bda)) {
-        LOG_DEBUG("%s, the l2cap chanel is congest.", __func__);
+        LOG_DEBUG("%s, the l2cap channel is congest.", __func__);
         return ESP_FAIL;
     }
 
+    if (handle == 0) {
+        return ESP_GATT_INVALID_HANDLE;
+    }
+
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_GATTC;
     msg.act = BTC_GATTC_ACT_WRITE_CHAR_DESCR;
@@ -615,10 +723,14 @@ esp_err_t esp_ble_gattc_prepare_write(esp_gatt_if_t gattc_if,
     }
 
     if (L2CA_CheckIsCongest(L2CAP_ATT_CID, p_tcb->peer_bda)) {
-        LOG_DEBUG("%s, the l2cap chanel is congest.", __func__);
+        LOG_DEBUG("%s, the l2cap channel is congest.", __func__);
         return ESP_FAIL;
     }
 
+    if (handle == 0) {
+        return ESP_GATT_INVALID_HANDLE;
+    }
+
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_GATTC;
     msg.act = BTC_GATTC_ACT_PREPARE_WRITE;
@@ -652,10 +764,14 @@ esp_err_t esp_ble_gattc_prepare_write_char_descr(esp_gatt_if_t gattc_if,
     }
 
     if (L2CA_CheckIsCongest(L2CAP_ATT_CID, p_tcb->peer_bda)) {
-        LOG_DEBUG("%s, the l2cap chanel is congest.", __func__);
+        LOG_DEBUG("%s, the l2cap channel is congest.", __func__);
         return ESP_FAIL;
     }
 
+    if (handle == 0) {
+        return ESP_GATT_INVALID_HANDLE;
+    }
+
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_GATTC;
     msg.act = BTC_GATTC_ACT_PREPARE_WRITE_CHAR_DESCR;
@@ -694,6 +810,10 @@ esp_err_t esp_ble_gattc_register_for_notify (esp_gatt_if_t gattc_if,
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
+    if (handle == 0) {
+        return ESP_GATT_INVALID_HANDLE;
+    }
+
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_GATTC;
     msg.act = BTC_GATTC_ACT_REG_FOR_NOTIFY;
@@ -712,6 +832,10 @@ esp_err_t esp_ble_gattc_unregister_for_notify (esp_gatt_if_t gattc_if,
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
+    if (handle == 0) {
+        return ESP_GATT_INVALID_HANDLE;
+    }
+
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_GATTC;
     msg.act = BTC_GATTC_ACT_UNREG_FOR_NOTIFY;

components/bt/host/bluedroid/api/esp_sdp_api.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -15,6 +15,24 @@
 
 #if (defined BTC_SDP_INCLUDED && BTC_SDP_INCLUDED == TRUE)
 
+static bool esp_sdp_record_integrity_check(esp_bluetooth_sdp_record_t *record)
+{
+    bool ret = true;
+
+    if (record != NULL) {
+        if (record->hdr.service_name_length > ESP_SDP_SERVER_NAME_MAX ||
+            strlen(record->hdr.service_name) + 1 != record->hdr.service_name_length) {
+            LOG_ERROR("Invalid server name!\n");
+            ret = false;
+        }
+    } else {
+        LOG_ERROR("record is NULL!\n");
+        ret = false;
+    }
+
+    return ret;
+}
+
 esp_err_t esp_sdp_register_callback(esp_sdp_cb_t callback)
 {
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -85,9 +103,7 @@ esp_err_t esp_sdp_create_record(esp_bluetooth_sdp_record_t *record)
 {
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
-    if (record == NULL || record->hdr.service_name_length > ESP_SDP_SERVER_NAME_MAX
-            || strlen(record->hdr.service_name)+1 != record->hdr.service_name_length) {
-        LOG_ERROR("Invalid server name!\n");
+    if (!esp_sdp_record_integrity_check(record)) {
         return ESP_ERR_INVALID_ARG;
     }
 
@@ -100,7 +116,7 @@ esp_err_t esp_sdp_create_record(esp_bluetooth_sdp_record_t *record)
     msg.act = BTC_SDP_ACT_CREATE_RECORD;
 
     memset(&arg, 0, sizeof(btc_sdp_args_t));
-    arg.creat_record.record = (bluetooth_sdp_record *)record;
+    arg.create_record.record = (bluetooth_sdp_record *)record;
 
     /* Switch to BTC context */
     stat = btc_transfer_context(&msg, &arg, sizeof(btc_sdp_args_t),

components/bt/host/bluedroid/api/include/api/esp_bt_defs.h

@@ -145,6 +145,25 @@ typedef uint8_t esp_link_key[ESP_BT_OCTET16_LEN];      /* Link Key */
 #define ESP_BLE_CONN_SUP_TOUT_MIN           0x000A       /*!< relate to BTM_BLE_CONN_SUP_TOUT_MIN in stack/btm_ble_api.h */
 #define ESP_BLE_CONN_SUP_TOUT_MAX           0x0C80       /*!< relate to ESP_BLE_CONN_SUP_TOUT_MAX in stack/btm_ble_api.h */
 
+#define ESP_BLE_PHY_1M_PREF_MASK       (1 << 0) /*!< The Host prefers use the LE1M transmitter or receiver PHY */
+#define ESP_BLE_PHY_2M_PREF_MASK       (1 << 1) /*!< The Host prefers use the LE2M transmitter or receiver PHY */
+#define ESP_BLE_PHY_CODED_PREF_MASK    (1 << 2) /*!< The Host prefers use the LE CODED transmitter or receiver PHY */
+typedef uint8_t esp_ble_phy_mask_t;
+
+/**
+* @brief create connection parameters
+*/
+typedef struct {
+    uint16_t scan_interval;       /*!< Initial scan interval, in units of 0.625ms, the range is 0x0004(2.5ms) to 0xFFFF(10.24s). */
+    uint16_t scan_window;         /*!< Initial scan window, in units of 0.625ms, the range is 0x0004(2.5ms) to 0xFFFF(10.24s). */
+    uint16_t interval_min;        /*!< Minimum connection interval, in units of 1.25ms, the range is 0x0006(7.5ms) to 0x0C80(4s). */
+    uint16_t interval_max;        /*!< Maximum connection interval, in units of 1.25ms, the range is 0x0006(7.5ms) to 0x0C80(4s). */
+    uint16_t latency;             /*!< Connection latency, the range is 0x0000(0) to 0x01F3(499). */
+    uint16_t supervision_timeout; /*!< Connection supervision timeout, in units of 10ms, the range is from 0x000A(100ms) to 0x0C80(32s). */
+    uint16_t min_ce_len;          /*!< Minimum connection event length, in units of 0.625ms, setting to 0 for no preferred parameters. */
+    uint16_t max_ce_len;          /*!< Maximum connection event length, in units of 0.625ms, setting to 0 for no preferred parameters. */
+} esp_ble_conn_params_t;
+
 /// Check the param is valid or not
 #define ESP_BLE_IS_VALID_PARAM(x, min, max)  (((x) >= (min) && (x) <= (max)) )
 
@@ -209,6 +228,8 @@ typedef uint8_t esp_ble_key_mask_t;            /* the key mask type */
 #define ESP_BD_ADDR_STR         "%02x:%02x:%02x:%02x:%02x:%02x"
 #define ESP_BD_ADDR_HEX(addr)   addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]
 
+#define ESP_BLE_ADV_NAME_LEN_MAX 29
+
 #ifdef __cplusplus
 }
 #endif

components/bt/host/bluedroid/api/include/api/esp_bt_main.h

@@ -95,6 +95,11 @@ esp_err_t esp_bluedroid_init_with_cfg(esp_bluedroid_config_t *cfg);
  */
 esp_err_t esp_bluedroid_deinit(void);
 
+#if defined(CONFIG_EXAMPLE_CI_ID) && defined(CONFIG_EXAMPLE_CI_PIPELINE_ID)
+// Only for internal used (CI example test)
+char *esp_bluedroid_get_example_name(void);
+#endif
+
 #ifdef __cplusplus
 }
 #endif